Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles

T1Covered by 1 source · first reported by Wiz Research at 25 Oct, 17:55 UTC

An automated campaign is planting secret-dumping workflows in every repository that stolen GitHub tokens can reach. It uses no C2 server, is actively evolving, and has been significantly disrupted by recent GitHub security improvements.

devsecurity

Sources

• T1Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens StumblesWiz Research25 Oct, 17:55