Our takeGheist attackers used stolen GitHub tokens to push secret-stealing workflows into 13,500+ branches and repos. Corroborated but they stumbled; rotate any exposed tokens and audit your CI pipelines now.Security Resilience desk
Sources (2)
- infosec_mag · infosec_mag
- darkreading · darkreading
What this means for you — Security leader:Audit GitHub tokens and workflows in all orgs; revoke any that appear in the Gheist campaign and block secret-stealing workflow patterns.
What this means for you — Lean IT orgs:Check your GitHub repositories for any unexpected workflow files that try to steal secrets; rotate any tokens you use for automation.
What this means for you — MSP:Scan client GitHub orgs for Gheist-style secret-stealing workflows and exposed tokens; advise immediate rotation and workflow review.
What this means for you — Researcher:Monitor for new Gheist IOCs and test your own repos for similar workflow abuse.