Overview
- Wiz researchers say they have tracked Gheist since September 15 and recovered more than 13,500 planted ci-sync-* branches created from over 850 compromised GitHub accounts.
- The tool creates a branch that adds a .github/workflows/sync-check.yml file which prints every secret the workflow can read, encodes those values in base32 to bypass masking, downloads the log via the GitHub API, and then deletes the run.
- GitHub’s July 28 approval hold blocked all public runs Wiz inspected, but the hold applies only to public github.com repositories and did not stop successful executions in private repos or on GitHub Enterprise Server.
- A variant added a job targeting self-hosted runners that searches for host credentials and files, but Wiz describes that job as buggy and reports no confirmed successful host compromises.
- Wiz published IOCs and guidance urging teams to hunt for ci-sync branches and the gheist user agent, rotate any exposed secrets, revoke compromised tokens, require environment reviewers, scope OIDC trust, and treat any self-hosted runner that ran the job as potentially compromised.