GHEIST: ATTEMPTED SCALED ABUSE OF STOLEN GITHUB TOKENS STUMBLES

Summary from the TLDR InfoSec newsletter

Attackers wielding stolen GitHub tokens from more than 850 accounts planted over 13,500 "sync-check" workflows that base32-encode repository and environment secrets to evade log masking, then pulled the logs through GitHub's own API and deleted the runs. GitHub's approval hold blocked every public-repository run, but private repositories and GitHub Enterprise Server executed the payload, with a newer variant sweeping self-hosted runners for cloud, Kubernetes, and AI provider credentials. Defenders should hunt for ci-sync-* branches, the gheist user agent, and OIDC role assumptions from those branches, then rotate every secret an affected repository could reach, since deleting the branch does not undo the exposure.