An ongoing attack is abusing compromised GitHub tokens to harvest cloud secrets and credentials from thousands of developer repositories, bringing into focus how compromised developer accounts can provide a gateway into enterprise cloud environments.

Dubbed “Gheist,” the campaign has left more than 13,500 malicious branches — or versions of a project’s code — across more than 850 compromised GitHub accounts, according to a report published over the weekend by Wiz Research.

The campaign affects everything from personal projects to private enterprise repositories, although public repositories are protected by safeguards GitHub introduced in July, according to the report.