An ongoing cyber campaign is leveraging stolen GitHub tokens to compromise private repositories by embedding workflows that reveal repository secrets through GitHub Actions logs. This malicious activity, identified by cloud security firm Wiz, has successfully infiltrated both private repositories and GitHub Enterprise environments.
While GitHub has implemented measures to halt suspicious workflows in public repositories, these safeguards do not extend to private or enterprise repositories. The orchestrated attack creates new branches labeled ‘ci-sync-‘ with random suffixes, executing workflows that expose repository secrets. Despite the deletion of branches or runs, the exposure remains irreversible.
Unmasking the Gheist Campaign
Wiz has been monitoring this campaign, named ‘Gheist’ after the user agent used in GitHub API requests, since mid-September. The attack has resulted in over 13,500 compromised branches across more than 850 accounts, affecting both individual projects and enterprise repositories. The precise number of exposed secrets remains undisclosed.
GitHub’s audit logs for private repositories and enterprise servers reveal completed runs on these branches, subsequently deleted by the Gheist user agent. Additionally, AWS CloudTrail logs indicate unauthorized role assumptions within affected organizations, hinting at unapproved GitHub Actions executions.
Escalating Threats and Mitigation Efforts
The attackers employ various user tokens to clone repositories and execute malicious workflows, later using the gathered cloud credentials to explore AWS Secrets Manager. Despite GitHub’s interventions on public repositories, the campaign persists, with many affected accounts disappearing from the platform, likely due to reports made by Wiz.
The attack tool initiates a branch creation process, embedding a workflow file titled ‘.github/workflows/sync-check.yml’ with an unsigned commit. This workflow captures and encodes job secrets, bypassing GitHub’s masking protocols. The attackers download the logs, ensuring no external server connections, making it challenging to block the exfiltration of secrets.
Protecting Your GitHub Repositories
GitHub has enhanced security measures to detect potentially malicious workflows, though these currently apply only to public repositories. As a precaution, Wiz recommends organizations conduct thorough checks for suspicious branches and review any GitHub Actions logs for unauthorized activities.
If any ‘ci-sync-‘ branches are detected, immediate action includes rotating all relevant secrets and revoking compromised tokens. Additional measures involve reviewing OAuth and OIDC settings to restrict access to sensitive environments and employing GitHub Apps or short-lived tokens to mitigate future risks.
By implementing these strategies, organizations can enhance their security posture, safeguarding their repositories from ongoing threats. Continuous monitoring and prompt response to suspicious activities remain critical in mitigating the impact of such sophisticated cyber attacks.
