Post

Since September 15, 2026, Wiz Research has tracked the Gheist campaign, which abuses compromised GitHub tokens to exfiltrate repository secrets. The attack creates branches with a workflow that logs secrets, which are then downloaded and deleted.