Gheist campaign plants secret-dumping workflows using stolen GitHub tokens
An automated campaign is planting secret-dumping workflows in every repository that stolen GitHub tokens can reach. It uses no C2 server, is actively evolving, and has been significantly disrupted by recent GitHub security improvements.
Read the full story at Hacker News ↗
ImpactTop story 73/100
Why it mattersnimble: high (p 0.28)
RegionsGlobal
Published1 d ago (Sun, 25 Oct 2026 19:10:36 GMT)
RetrievedSun, 25 Oct 2026 21:01:16 GMT via api
ClassifiedSun, 25 Oct 2026 21:33:05 GMT by nimble
Authorhttps://www.wiz.io/authors/rami-mccarthy