Wiz describes the Gheist campaign, in which attackers used stolen GitHub tokens to mass-create branches named with a ci-sync- prefix in victims’ repositories. The branches contained GitHub Actions workflows designed to print repository secrets into run logs, where the attackers could collect them. According to Wiz, the campaign stumbled and did not succeed at scale. The company recommends revoking tokens that may have been exposed and rotating all secrets in affected repositories.

What it means: GitHub access tokens are now among the most valuable targets, because they lead not only to code but also to the secrets automated workflows use: cloud keys, database passwords and package publishing credentials. The campaign’s technique is simple: instead of stealing secrets directly, the attackers make the build system print them. The fact that this campaign failed does not mean the next one will. For Greek software companies and development teams, the basic measures are well known but often not applied: fine-grained tokens with limited permissions and an expiry date instead of unrestricted classic tokens, branch protection so that workflows with access to secrets only run from approved branches, and alerts for new branches or workflows that appear unexpectedly. GitHub also masks secrets in logs only when they appear verbatim, so encoded versions can still leak. Anyone who finds ci-sync- branches they did not create should treat the repository’s secrets as exposed and rotate them at once.

Read the original on Wiz

Related service: Custom software

Related stories