Gheist campaign plants secret-dumping workflows using stolen GitHub tokens
The Gheist campaign, identified by security researchers, exploits compromised GitHub access tokens to insert malicious workflow files into repositories. These hidden workflows automatically collect and transmit repository secrets, such as API keys, to attacker-controlled servers. By leveraging legitimate CI/CD mechanisms, the operation evades detection and can affect any project where the stolen token grants write access.