Search — “.github/workflows/sync-check.yml”

Wiz has tracked Gheist since Sept 15, 2026: an automated tool using stolen GitHub tokens (infostealer logs, Trivy compromise) pushes ci-sync-XXXXXX branches with .github/workflows/sync-check.yml that base32-encodes env and all secrets into Actions logs, downloads the log via API, and deletes the run seconds later. Public-repo runs were held by GitHub's approval control and never ran, but Wiz observed successful exploitation in private repos and GitHub Enterprise, with follow-on AWS Secrets Manager enumeration; a buggy self-hosted runner credential-sweep job (no reported successful run) appeared Oct 19. Hunt for ci-sync- branches, the 'gheist' user agent in GitHub audit logs, quickly deleted runs, OIDC role assumptions with ci-sync- subjects, and .gdmp_* files on runners.