Attackers Use Stolen GitHub Tokens to Drain Private Repository Secrets

Attackers used stolen GitHub user and automation tokens to plant a workflow on ci-sync- branches. Wiz Research recovered more than 13,500 planted branches tied to more than 850 compromised accounts. In private repositories and GitHub Enterprise Server environments, Wiz observed completed Actions runs and subsequent use of credentials; public runs it checked were held at action_required.

The planted .github/workflows/sync-check.yml prints encoded secrets into its own run log. The tool retrieves the log through GitHub’s API and deletes the run seconds later. A variant adds a sync-host job, apparently for repositories with a registered self-hosted runner, to collect host credentials. Look for branches matching ^ci-sync-[0-9a-z]{6}$, a commit with message ci: sync config, deleted runs and user agent gheist. If AWS OIDC is configured, inspect CloudTrail role assumptions whose subject contains ci-sync-; cloud telemetry can survive the deleted GitHub run. Runner files .gdmp_pat, .gdmp_patg and .gdmp_sweep, and job marker gdmp-pivot, warrant host investigation.

Revoke the token that pushed a matching workflow, rotate repository, organization and environment secrets available to the run, and investigate the token owner’s device. Isolate and rebuild a self-hosted runner that executed the second job. Require production-environment reviewers and restrict AWS OIDC trust to protected branches or protected environments. Verify that the production role rejects an unprotected branch. Preserve audit and cloud events promptly: a deleted run can leave today’s Actions list looking ordinary.