Gheist campaign plants secret-dumping workflows using stolen GitHub tokens

Since September 15, 2026, the Gheist campaign has compromised over 850 GitHub accounts and planted malicious workflows in more than 13,500 repositories to steal secrets and credentials. The attack creates fake workflow files that encode repository secrets in base32 to bypass GitHub's masking protections, then exfiltrates them through GitHub's own API, making the activity difficult to detect. The ongoing campaign has successfully targeted private repositories and enterprise environments, with evidence of attackers using stolen cloud credentials to access AWS Secrets Manager and other systems.