Gheist campaign commits 13,500 branches to 850 GitHub accounts since September 15 2026

The campaign created ci-sync- branches in every reachable repository, committed .github/workflows/sync-check.yml, and triggered runs that printed secrets via matrixed environment jobs. Tool B added self-hosted runner pivots on October 19 that searched for 31 token formats, AWS instance metadata, and Kubernetes tokens. GitHub's July 28 workflow approval hold blocked public repo runs but left private and enterprise repositories exposed. Wiz recovered 13,500 branches; two-thirds of accounts later disappeared, consistent with remediation after disclosure. The attack evaded outbound filtering because exfiltration used GitHub API endpoints and masked values only when secrets appeared verbatim. Environment-scoped secrets from deployment matrices were also dumped. GitHub Actions token abuse now demonstrates that repository secrets and runner credentials must be treated as high-value targets equivalent to cloud IAM keys. Organizations running self-hosted runners face additional host enumeration risk. Continued evolution of the payload shows operators adapting within hours of each GitHub control change. GitHub will need to extend approval holds or introduce secret-reference validation to private repositories within the next 60 days or similar campaigns will persist.