Zero Radar
← feed
HighSecurity incidentupdated 26 Oct 2026, 09:22 UTC

Stolen GitHub tokens used to leak repository secrets through build logs

Attackers who steal GitHub login tokens are adding hidden automated jobs to code projects that print the project's passwords and keys into the build logs. The attackers then download those logs and delete them, so the secrets leave without

Attacks reported (Wiz Research, The Hacker News)2 independent sources
SeverityHighSecurity incident
Being exploited?ReportedBy Wiz Research, The Hacker News, not officially confirmed yet
What to doCheck exposureRevoke any potentially stolen GitHub tokens and rotate the secrets stored in affected repositories.
How sure is this?2 independent sourcesSeveral independent publishers agree

How the attack works simplified

  1. 1Stolen tokenAttacker obtains a GitHub token
  2. 2Plant workflowAdds a job that prints secrets to logs
  3. 3Secrets in logsRepository secrets appear in Actions logs
  4. 4Download logsAttacker downloads the logs, then deletes the runs
  5. ResultRepository secrets are stolen

What happened

An automated campaign called Gheist uses stolen GitHub tokens to plant GitHub Actions workflows that dump repository secrets into Actions logs, which the attackers download and then delete. It reportedly succeeds in private repositories and GitHub Enterprise environments and uses no command-and-control server.

Why it is dangerous: Any secret stored in a repository, such as API keys, cloud credentials or deployment tokens, can be stolen, letting attackers reach other systems. Teams with private repositories and GitHub Enterprise users, especially those whose tokens may have been exposed, are at risk.

Are you affected?

You are affected if your GitHub tokens or accounts have been stolen and your repositories store secrets that Actions workflows can access.

GitHub private repositories and GitHub Enterprise environments reachable with stolen GitHub tokens.

What to do

  1. Revoke and rotate any GitHub tokens that may have been exposed or stolen
  2. Review recent workflow runs and workflow files for unfamiliar secret-dumping jobs
  3. Rotate secrets stored in affected repositories, such as API keys and deployment credentials
  4. Enable and follow GitHub's recent security safeguards that pause suspicious activity

Timeline

  1. 25 Oct 2026, 17:55 UTC
    Publicly disclosed
  2. 25 Oct 2026, 17:55 UTC
    Reported by Wiz Research · Wiz Research
  3. 25 Oct 2026, 18:51 UTC
    Picked up by Zero Radar
  4. 26 Oct 2026, 09:22 UTC
    The Hacker News reported on it · The Hacker News

Sources 2 reports, oldest first

Security researchers research teams and mailing lists

Security press established security newsrooms

Technical details

ID
ZR-d91f0b10
Disclosed
25 Oct 2026, 17:55 UTC
On Zero Radar
25 Oct 2026, 18:51 UTC (56 min after disclosure)
Last change
26 Oct 2026, 09:22 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Stolen GitHub tokens used to leak repository secrets through build logs · Zero Radar