GHEIST: ATTEMPTED SCALED ABUSE OF STOLEN GITHUB TOKENS STUMBLES

Summary from the TLDR DevOps newsletter

Gheist is an automated campaign that plants secret-dumping workflows in repositories using stolen GitHub tokens. It has targeted over 850 compromised accounts since September 15. GitHub's recent security controls blocked the attack in public repositories, but private and enterprise environments remain vulnerable.