Zero Radar
← feed
HighSecurity incidentupdated 26 Oct 2026, 18:17 UTC

Malicious campaign 'Gheist' steals GitHub tokens and cloud secrets

Attackers are using stolen GitHub access tokens to take passwords and cloud keys from software developers' code projects. Anyone whose project or access tokens are caught in this could have their cloud accounts and private data exposed.

Attacks reported (Dark Reading)1 source, unconfirmed
SeverityHighSecurity incident
Being exploited?ReportedBy Dark Reading, not officially confirmed yet
What to doCheck exposureRevoke and rotate GitHub tokens and cloud secrets that may be exposed.
How sure is this?1 source, unconfirmedOnly one publisher so far, details may change

How the attack works simplified

  1. 1Attacker abuses tokensUses GitHub tokens to reach repositories
  2. 2Repositories accessedThousands of developer repositories targeted
  3. 3Secrets harvestedCredentials and sensitive data are collected
  4. 4Cloud access gainedStolen secrets used against cloud accounts
  5. ResultAttacker reaches cloud secrets and data

What happened

An ongoing supply chain attack, dubbed 'Gheist', abuses GitHub tokens to harvest credentials and sensitive data from thousands of developer repositories.

Why it is dangerous: Stolen cloud secrets can let attackers access company infrastructure and data, and compromised repositories can spread the attack to downstream users. Developers and organizations that store secrets in repositories are at risk.

Are you affected?

You are affected if your developers use GitHub repositories that contain or have access to cloud secrets or credentials.

unknown

What to do

  1. Revoke and rotate any GitHub tokens that may have been exposed
  2. Rotate cloud credentials and secrets stored in affected repositories
  3. Review repositories for committed secrets and remove them from history
  4. Monitor cloud and GitHub audit logs for unusual access

Timeline

  1. 26 Oct 2026, 18:01 UTC
    Publicly disclosed
  2. 26 Oct 2026, 18:01 UTC
    Reported by Dark Reading · Dark Reading
  3. 26 Oct 2026, 18:17 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Security press established security newsrooms

Technical details

ID
ZR-e6cb2418
Disclosed
26 Oct 2026, 18:01 UTC
On Zero Radar
26 Oct 2026, 18:17 UTC (16 min after disclosure)
Last change
26 Oct 2026, 18:17 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Malicious campaign 'Gheist' steals GitHub tokens and cloud secrets · Zero Radar