Gheist攻击活动利用被盗GitHub令牌植入恶意工作流窃取机密

Wiz Research追踪到一场名为Gheist的自动化攻击活动，自2026年9月15日以来持续针对GitHub平台进行大规模恶意操作1。攻击者利用被盗的GitHub令牌，在超过850个被入侵账户的13500多个仓库中植入恶意工作流，窃取存储库机密1。这些被盗令牌涵盖从个人项目到企业私有仓库1。截至2026年10月24日，约三分之二的涉及账户已从GitHub平台移除1。

攻击的技术特征表明了针对性的设计与持续演进。恶意工作流被命名为"sync-check"，分支命名格式为"ci-sync-"加六个随机字符，提交消息统一为"ci: sync config"，用户代理标识为"gheist"1。攻击者通过GitHub API提取日志并快速删除痕迹，未使用传统的C2服务器1。在2026年9月28日工具首次运行数小时后，攻击者添加了timeout-minutes配置和environment matrix，到10月19日又加入了base32编码和分隔符"LAFA===="1。此活动搜索31种令牌格式，包括来自Anthropic、Hugging Face、Groq和NVIDIA的API密钥1。

GitHub已采取防御措施应对此类威胁。自2026年7月28日起，平台对公开仓库的恶意工作流实施了审批保留机制，成功阻止了针对公开仓库的类似攻击1。然而，私有仓库和企业环境仍存在成功利用的案例1。研究表明Gheist活动与PolinRider（朝鲜黑客组织）、Megalodon等其他活动存在重叠1。

Wiz Research has identified an automated attack campaign called Gheist that has been systematically compromising GitHub repositories since September 15, 2026 1. The operation leverages stolen GitHub tokens to inject malicious workflows into over 13,500 repositories across more than 850 compromised accounts, with the goal of exfiltrating stored secrets and credentials 1. The attackers extract logs through the GitHub API and promptly delete evidence without relying on command-and-control infrastructure 1.

The malicious workflows are consistently named "sync-check" and deployed to branches following the pattern "ci-sync-" followed by six random characters 1. Associated commits carry the message "ci: sync config," and the threat actor identifies itself through the user agent "gheist" 1. Since GitHub implemented mandatory approval controls for workflows in public repositories beginning July 28, 2026, the campaign has continued to succeed against private repositories and enterprise environments 1. As of October 24, 2026, approximately two-thirds of the affected accounts have been removed from GitHub 1.

The stolen tokens span from personal projects to enterprise private repositories 1. The attackers have progressively refined their technique: Tool B added timeout configurations and environment matrices shortly after its first execution on September 28, and later introduced base32 encoding with the separator "LAFA====" on October 19 1. The campaign systematically searches for 31 different token formats belonging to providers including Anthropic, Hugging Face, Groq, and NVIDIA 1. Security researchers have identified overlaps between Gheist and other known threat operations, including PolinRider and Megalodon 1.