Gheist turns GitHub Actions into a secret extraction service

The Gheist campaign shows how compromised GitHub accounts can be turned into credential-harvesting infrastructure, with attackers using GitHub Actions in private repositories to expose repository, environment, and even self-hosted runner secrets. For CIOs and technology leaders, the business risk is broader than source code theft: exposed cloud credentials can lead to account takeover, unauthorized cloud access, and downstream disruption, especially in enterprise environments where GitHub’s public-repo protections do not apply. IT organizations should treat developer platforms as part of the security perimeter and assume that deleting a malicious branch or workflow does not undo secret exposure.