Gheist campaign plants secret-dumping workflows using stolen GitHub tokens

Wiz Research reports Gheist, a campaign that uses stolen GitHub tokens to push a sync-check workflow to every reachable repository, dump secrets into the run log in base32 to evade masking, fetch the log through the API, and delete the run. Wiz recovered over 13,500 branches from 850+ accounts. GitHub's approval hold stopped public-repo runs, but not private or Enterprise Server ones, where cloud credentials were later used. Wiz's figures are self-reported; rotate exposed secrets and scope OIDC trust to protected branches.