// GitHubHIGH
Gheist campaign has compromised over 850 GitHub accounts since September 15, 2026, injecting malicious workflows named sync-check into repositories to exfiltrate CI/CD secrets. The automated attack plants workflows that base32-encode repository secrets to bypass GitHub's masking, with tool variants evolving to extract credentials from self-hosted runners, cloud providers, and Kubernetes environments. GitHub's approval hold blocks execution in public repositories, but private repositories and enterprise environments remain vulnerable to active, ongoing exploitation.
// Get alerts for GitHub