Gheist Weaponizes GitHub Tokens to Steal Cloud Secrets

Introduction

An ongoing supply chain attack identified as Gheist is actively harvesting credentials and sensitive data from thousands of developer repositories across multiple cloud platforms. The threat leverages GitHub personal access tokens, which many teams store in code repositories or CI/CD configuration files, to gain unauthorized access to cloud resources. By abusing these tokens, the attackers can read, modify, or exfiltrate secrets that were previously thought to be protected by conventional perimeter defenses, thereby exposing both individual developers and the broader software supply chain to significant risk. The campaign has been observed across diverse industries, including fintech, healthcare, and SaaS providers, indicating its broad relevance and the urgency for coordinated defensive actions.

Supply Chain Impact

The breach enables attackers to extract environment variables, API keys, and private repository contents that frequently hold credentials for cloud services such as compute instances, storage buckets, and database instances. With these secrets in hand, the adversaries can provision unauthorized resources, exfiltrate proprietary data, or deploy ransomware across multiple tenant environments, leading to financial loss, reputational damage, and potential regulatory penalties for the affected organizations. The sheer volume of compromised credentials amplifies the risk, as a single token can grant access to numerous services and accounts within a single organization.

Attack Mechanics

Gheist begins by programmatically scanning public and private GitHub repositories for stored personal access tokens, which are commonly used to authenticate continuous integration and delivery pipelines as well as third‑party services. When a token is discovered, the attacker leverages it to clone repositories, enumerate cloud accounts linked to the token holder, and retrieve secret files that may reside in configuration files or environment variables. This stolen token then enables lateral movement within cloud accounts, allowing the adversary to read, modify, or delete resources without triggering typical network‑based alerts, thereby expanding the attack surface far beyond the original codebase. The compromised token can also be leveraged to pivot across interconnected cloud accounts, exposing additional assets and increasing the attack surface for downstream victims. Because the token grants API‑level permissions, the attacker can programmatically list, modify, or delete resources such as virtual machines, storage buckets, and database instances, often bypassing traditional perimeter security controls. These activities can remain undetected for extended periods, as the attacker operates within legitimate authenticated sessions, making forensic detection challenging.

Practical Mitigation

Defenders should immediately rotate any GitHub personal access tokens that appear in logs or are associated with active CI/CD workflows, enforce short‑lived token lifetimes, and require multi‑factor authentication for all privileged accounts. Deploying secret‑scanning tools that automatically detect credentials in source code, restricting token scopes to the minimum necessary permissions, and integrating automated secret management solutions further limit exposure. Regular audits of repository access logs and prompt revocation of unused tokens are essential practices to maintain a strong security posture. Additionally, organizations should implement policy controls that require token expiration after a defined period and monitor for anomalous token usage patterns through security information and event management (SIEM) platforms, enabling rapid response to potential abuse.

Conclusion

The Gheist campaign demonstrates how the convergence of cloud services and developer tooling creates new supply chain exploitation pathways, demanding vigilant token hygiene and proactive secret management. Grivyonx’s AI‑driven automation and DevSecOps cloud security services empower enterprises to detect and remediate token misuse at scale, reinforcing protective measures across the software development lifecycle.