OTX Threat: Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles

Since September 15, 2026, an automated campaign named Gheist has been performing mass abuse of compromised GitHub tokens. The attack commits a workflow named sync-check to every accessible repository, designed to print repository secrets into workflow logs. These secrets are then exfiltrated through GitHub's API and the logs deleted seconds later. Over 13,500 planted branches from more than 850 co CVEs: CVE-2026-111497