Gheist turns GitHub Actions into a secret extraction service

Publisher excerpt From CSO Online

A threat actor dubbed Gheist is turning compromised GitHub accounts into credential-harvesting platforms. By planting malicious GitHub Actions workflows in private repositories, the attackers can expose repository and environment secrets, then retrieve them through GitHub APIs before deleting evidence of the activity. Tracked since September 15 by Wiz Research, the campaign has left more than 13,500 malicious branches across over 850 compromised accounts, spanning personal projects and private enterprise repositories. The campaign’s weapon is GitHub Actions, the platform’s automation service, which attackers are using to turn stolen access into harvested credentials. The automation creates a branch, adds a workflow named “sync-check” that attempts to print secrets into execution logs, retrieves those logs through the GitHub API, and deletes the workflow run seconds later. “Because the secrets leave through GitHub’s own API, there is no attacker domain or outbound connection to block,” Wiz researchers said in a blog post. GitHub has introduced a control that holds potentially malicious workflow runs in public repositories for collaborator approval. Wiz reported that this measure successfully prevented the public-repository Gheist runs from executing. However, the protection does not extend to private repositories or GitHub Enterprise Server, where the researchers observed successful execution and subsequent activity. Base32 encoding used for bypassing secret masking Ghe…

Excerpt only, shown with attribution. This content belongs to the original publisher and has not been independently verified by CyberSecurity.pk.