{"id":245995,"date":"2026-10-27T05:36:57","date_gmt":"2026-10-27T10:36:57","guid":{"rendered":"https:\/\/lifeboat.com\/blog\/2026\/10\/gheist-weaponizes-github-tokens-to-steal-cloud-secrets"},"modified":"2026-10-27T05:36:57","modified_gmt":"2026-10-27T10:36:57","slug":"gheist-weaponizes-github-tokens-to-steal-cloud-secrets","status":"publish","type":"post","link":"https:\/\/lifeboat.com\/blog\/2026\/10\/gheist-weaponizes-github-tokens-to-steal-cloud-secrets","title":{"rendered":"\u2018Gheist\u2019 Weaponizes GitHub Tokens to Steal Cloud Secrets"},"content":{"rendered":"\n<p>An ongoing attack is abusing compromised <a class=\"\" href=\"https:\/\/www.darkreading.com\/application-security\/ai-assisted-supply-chain-attack-targets-github\" target=\"_self\" data-discover=\"true\">GitHub tokens<\/a> to harvest cloud secrets and credentials from thousands of <a class=\"\" href=\"https:\/\/www.darkreading.com\/cyberattacks-data-breaches\/water-curse-targets-cybersecurity-pros-github-repos\" target=\"_self\" data-discover=\"true\">developer repositories<\/a>, bringing into focus how compromised developer accounts can provide a gateway into enterprise cloud environments.<\/p>\n<p>Dubbed \u201cGheist,\u201d the campaign has left more than 13,500 malicious branches \u2014 or versions of a project\u2019s code \u2014 across more than 850 compromised GitHub accounts, according to a report published over the weekend by Wiz Research.<\/p>\n<p>The campaign affects everything from personal projects to private enterprise repositories, although public repositories are protected by safeguards <a class=\"\" href=\"https:\/\/www.darkreading.com\/application-security\/megalodon-malware-infects-thousands-github-repos\" target=\"_self\" data-discover=\"true\">GitHub<\/a> introduced in July, <a class=\"\" rel=\"noreferrer\" target=\"_blank\" href=\"https:\/\/www.wiz.io\/blog\/gheist-attempted-scaled-abuse-of-stolen-github-tokens-stumbles\" data-airgap-id=\"31\">according to the report<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>An ongoing attack is abusing compromised GitHub tokens to harvest cloud secrets and credentials from thousands of developer repositories, bringing into focus how compromised developer accounts can provide a gateway into enterprise cloud environments. Dubbed \u201cGheist,\u201d the campaign has left more than 13,500 malicious branches \u2014 or versions of a project\u2019s code \u2014 across more [\u2026]<\/p>\n","protected":false},"author":427,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20],"tags":[],"class_list":["post-245995","post","type-post","status-publish","format-standard","hentry","category-futurism"],"_links":{"self":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/245995","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/users\/427"}],"replies":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/comments?post=245995"}],"version-history":[{"count":0,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/245995\/revisions"}],"wp:attachment":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/media?parent=245995"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/categories?post=245995"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/tags?post=245995"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}