Gheist
A supply chain attack campaign targeting GitHub in which attackers use stolen GitHub tokens to implant malicious GitHub Actions workflows in repositories, secretly exfiltrating sensitive data through the platform's infrastructure.
Timeline (last 90 days)
The Gheist campaign uses stolen GitHub tokens to implant malicious GitHub Actions workflow files in target repositories in order to steal data.
Defending against Gheist-type attacks should involve shortening GitHub token validity periods, assigning scopes according to the principle of least privilege, and mandating the use of fine-grained tokens.
Regularly scanning all workflow files in repositories, with a focus on anomalous outbound connection addresses, suspicious secrets-reading patterns, and unapproved scheduled tasks, is an effective audit measure.
According to Hacker News community discussion, the Gheist campaign currently has limited discussion traction on public channels (19 points, zero comments).
All Facts (4)
Defending against Gheist-type attacks should involve shortening GitHub token validity periods, assigning scopes according to the principle of least privilege, and mandating the use of fine-grained tokens.
50%UnverifiedRegularly scanning all workflow files in repositories, with a focus on anomalous outbound connection addresses, suspicious secrets-reading patterns, and unapproved scheduled tasks, is an effective audit measure.
50%UnverifiedAccording to Hacker News community discussion, the Gheist campaign currently has limited discussion traction on public channels (19 points, zero comments).
50%UnverifiedThe Gheist campaign uses stolen GitHub tokens to implant malicious GitHub Actions workflow files in target repositories in order to steal data.
50%