Gheist Campaign Steals GitHub Secrets via Stolen Tokens and Actions Logs
The Gheist group exploits stolen GitHub tokens to extract private repository secrets from GitHub Actions logs, impacting private and Enterprise GitHub environments.
Why it matters
This attack circumvents standard security controls, potentially exposing sensitive code and credentials, which may lead to increased risk of unauthorized access or data compromise.
SOC impact
Monitor GitHub Actions workflow logs and token usage for unusual activity that could indicate exploitation. Validate which repositories and environments have been accessed using stolen tokens. Review the integrity of secret management processes and audit repository access events for signs of unauthorized extraction and deletion of logs.
Recommended actions
- Identify repositories and environments affected by stolen GitHub tokens
- Monitor GitHub Actions logs for anomalous workflow deployments
- Audit secret usage and access patterns in private repositories
- Review token issuance and revoke suspicious or unused tokens
- Assess security controls around secret management in GitHub repositories
Executive Summary
The Gheist threat group is leveraging stolen GitHub tokens to deploy malicious workflows that extract private secrets from GitHub Actions logs. This method targets private repositories and GitHub Enterprise environments and involves removing traces by deleting evidence after extraction. Such activity eludes standard security mechanisms that protect repository secrets, increasing the potential exposure of sensitive credentials and code.
For security teams, this attack highlights the necessity of closely monitoring token use and GitHub Actions workflows for suspicious operations. Ensuring proper oversight of secret handling and token management in GitHub environments is critical to detecting and responding to this type of compromise.
SOC Impact
Monitor GitHub Actions workflow logs and token usage for unusual activity that could indicate exploitation. Validate which repositories and environments have been accessed using stolen tokens. Review the integrity of secret management processes and audit repository access events for signs of unauthorized extraction and deletion of logs.
Authentication and Access Validation
- Identify repositories and environments affected by stolen GitHub tokens
- Monitor GitHub Actions logs for anomalous workflow deployments
- Audit secret usage and access patterns in private repositories
- Review token issuance and revoke suspicious or unused tokens
- Assess security controls around secret management in GitHub repositories
Why It Matters
This attack circumvents standard security controls, potentially exposing sensitive code and credentials, which may lead to increased risk of unauthorized access or data compromise.