Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs

An automated campaign called Gheist is using stolen GitHub tokens to plant workflows that print a repository's secrets into GitHub Actions logs, download the secrets, then delete the runs. The attacks have succeeded in private repositories and GitHub Enterprise environments, according to cloud security company Wiz, which analyzed the campaign.