They use different tools and different tricks, and two different research teams found them. But both start in the same place: Developer credentials in the wrong hands. And in both cases, the controls defenders trust most missed the problem.
The first campaign, which Wiz Research calls Gheist after the user agent its tool sends to the GitHub API, has run since September 15. As of October 24, researchers had recovered more than 13,500 planted branches across more than 850 compromised accounts. The tool takes a stolen token and finds every repository it can reach.
In each one, it creates a branch named ci-sync- plus six random characters and commits a single workflow file, sync-check.yml, with the message "ci: sync config." The workflow prints the repository's secrets into its own Actions log. The tool downloads the log through the API and deletes the run seconds later. Two details make this hard to catch.
