Gheist Exploits Stolen GitHub Tokens to Extract Private Repository Secrets via Actions Logs

An automated campaign exploits stolen GitHub tokens to extract private repository secrets by printing them into GitHub Actions logs. The attack targets private repositories and GitHub Enterprise environments, as reported by Wiz.

An automated campaign is using stolen GitHub tokens to plant workflows that print a repository's secrets into its GitHub Actions logs, which the attackers then download before deleting the runs. The attacks have succeeded in private repositories and GitHub Enterprise environments, according to an analysis by cloud security company Wiz.

A GitHub safeguard that pauses

Read original article