Gheist campaign plants secret-dumping workflows using stolen GitHub tokens
Article, Comments
wiz.io
Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles | Wiz Blog
An automated campaign is planting secret-dumping workflows in every repository that stolen GitHub tokens can reach. It uses no C2 server, is actively evolving, and has been significantly disrupted by recent GitHub security improvements.
1October 25, 2026 2.4K 16
