An automated campaign named Gheist uses stolen GitHub tokens to inject workflows into repositories, printing secrets into Actions logs for exfiltration.
Wiz tracked over 13,500 planted branches across 850+ compromised accounts affecting private and enterprise environments.
How the attack works
The attackers use stolen access keys to automatically create new working branches in repositories. Each new branch starts with the name ci-sync- followed by six random characters.
They then add a file that instructs the system to print all the passwords and secrets stored in the repository to the log files. This data is encrypted to bypass the platform's automatic protection measures.
As soon as the process is complete, the perpetrators' tool downloads the files with sensitive data and deletes traces of execution within a few seconds.
The extent of the problem
Wiz’s research has shown that more than 13.500 compromised forks have been identified so far across over 850 accounts. The attacks have been successful in both private repositories and corporate environments.
READ ALSO
Hackers breached 97 accounts at dozens of organizations by stealing digital login keys
The platform has a security mechanism that freezes suspicious processes in public repositories, which stopped attacks at that level. However, this mechanism does not cover private repositories or corporate systems.
In organizations, the tool sequentially used user keys, copied private repositories, and then exploited cloud service credentials to search for additional codes.
The situation and protection measures
By the end of October the campaign was still running, although about two-thirds of the accounts involved were deactivated after Wiz reported the activity.
The researchers recommend immediately changing all exposed passwords, revoking the keys used, checking devices for spyware, and treating any affected autonomous systems as compromised.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
end of article
Top comments (0)