Gheist Abuses GitHub Tokens to Harvest Cloud Secrets Across Thousands of Repositories

En bref

• Gheist is actively misusing GitHub access tokens to reach cloud secrets.
• The campaign spans a repository footprint in the thousands.
• Stolen credentials can enable sensitive data access and downstream compromise.
• No CVE is associated; the risk is credential and secret exposure.

Gheist is conducting an ongoing campaign that relies on abused access tokens issued by GitHub to reach credentials and secrets stored in repositories and related workflows. The activity is not tied to a software vulnerability or CVE; instead, it centers on collecting usable authentication material and removing secrets that can unlock cloud environments.

The scope is significant: the campaign touches a repository footprint numbering in the thousands. That means affected organizations may include not only the repositories where tokens were exposed but also downstream projects and services that depend on those codebases. Because cloud credentials and other secrets are involved, the impact extends beyond GitHub itself.

For K-12 and government environments, the primary concern is credential theft that can lead to unauthorized access to sensitive data and cloud infrastructure. When secrets are harvested from source control, attackers may be able to move into build systems, deployment pipelines, or production services. This creates a supply chain compromise risk that can affect vendors, partners, and users who rely on the software produced by impacted repositories.

The absence of a CVE does not reduce the operational urgency. Token abuse and secret exfiltration often look like ordinary API traffic, so detection depends on reviewing token usage patterns, repository activity, and cloud authentication logs. Organizations should assume that any exposed token or secret may already be in use and should prioritize rotation and revocation.

What to watch: unusual GitHub API activity, unexpected access to repository secrets, new cloud logins from unfamiliar locations, and changes to CI/CD workflows. Administrators should also monitor for secrets committed in past history, not just current files, and review third-party integrations that hold repository access.

À faire maintenant

1. Audit GitHub access tokens and revoke or rotate any token with unclear ownership, excessive scope, or long expiration.
2. Scan repositories, commit history, CI/CD logs, and workflow files for exposed cloud credentials and other secrets; rotate every confirmed finding.
3. Enforce least privilege for GitHub tokens and integrations, replacing long-lived credentials with short-lived, scoped alternatives where possible.
4. Enable GitHub secret scanning and push protection, and review alerts for both current and historical repository content.
5. Review cloud identity and access logs for anomalous authentication tied to credentials stored in GitHub, then contain affected accounts.
6. Monitor GitHub audit logs and API activity for token misuse patterns, including unusual repository access and secret-related events.
7. Brief development teams on safe secret handling and require immediate reporting of suspected token or credential exposure.

Source originale

Dark Reading