> TritonInfoSec News
Home / Oct 26, 2026 / Story
0
#6 The Hacker News general October 26, 2026 at 07:49 UTC

Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs

By [email protected] (The Hacker News)

AI Summary

A threat actor tracked as Gheist is running an automated campaign using stolen GitHub tokens to inject malicious workflows that exfiltrate repository secrets via GitHub Actions logs, then delete the run evidence — successfully targeting both private repositories and GitHub Enterprise environments, per Wiz's analysis. Security teams using GitHub Actions should audit token permissions and monitor for unauthorized workflow modifications or unexpected Actions log downloads.

Read full article → https://thehackernews.com/2026/10/gheist-uses-stol…

Relevance score: 84.0/100

# More from October 26

  1. 1
    PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking The Hacker News
  2. 2
    PHP2Shell security flaws now sucessfully exploited in the wild BleepingComputer
  3. 3
    Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations The Hacker News
  4. 4
    BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot BleepingComputer
  5. 5
    Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages SecurityWeek
  6. 7
    Popular AI tool LiteLLM says unrevoked key allowed hackers to target users The Record
  7. 8
    Bias in Qwen3-Coder Model Schneier on Security
  8. 9
    Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware The Hacker News
  9. 10
    Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers The Hacker News