An active campaign is using stolen GitHub tokens to extract secrets from private repositories. More than 13,500 malicious branches were recovered across over 850 compromised accounts. The attacker plants a workflow that encodes secrets, writes them into a run log, downloads the log through GitHub’s API, and quickly deletes the evidence. Private repositories and self-hosted runners are exposed.
Why It Matters
The activity can reach production credentials and cloud roles without using an outside server. Public-repository safeguards do not apply in the same way to private repositories or GitHub Enterprise Server. For leaders: private code storage is not a security boundary when valid tokens are stolen. For defenders: deleted runs do not reverse exposure, so affected secrets must be rotated. The larger lesson is that developer identities are privileged paths into cloud infrastructure.
What Defenders Should Do
Hunt for ci-sync branches and the gheist user agent, then revoke tokens and rotate reachable secrets.