What Happened
The Hacker News reports Wiz has tracked a campaign called Gheist since September 15. Attackers use stolen GitHub tokens to push branches named ci-sync- plus six random characters. Each branch carries a workflow to print repository secrets, encoded in base32, into Actions logs.
The attackers download the logs and delete the workflow runs seconds later. The method needs no outbound connection, so network monitoring sees nothing. Wiz recovered more than 13,500 planted branches from over 850 compromised accounts, including private and enterprise repositories. Wiz has not said how many organizations had secrets exposed.
Why This Matters for Canadian Organizations
Canadian software firms, fintechs, and public sector development teams keep cloud keys, signing credentials, and API tokens in GitHub. One stolen personal access token gives an attacker a path to every secret the token reaches. Deleted runs leave little evidence, so a leak is easy to miss.
The exposure runs past your own code. Federally regulated institutions must manage third-party and technology risk under OSFI Guideline B-13, and a leaked credential tied to customer data triggers a PIPEDA breach assessment. Teams who rely on long-lived tokens carry the highest risk.
What to Do
Search your repositories for ci-sync- branches and review the audit log for workflow runs deleted within seconds. Rotate every secret the affected repositories reach and revoke the tokens used to push the branches. Do not approve held workflow runs or run code from these branches.
Require reviewers on production environments. Limit OIDC trust to protected branches. Replace personal access tokens with GitHub Apps or short-lived fine-grained tokens. See more in our TechTalk archive.
