Gheist Campaign Steals Secrets via GitHub

Cloud security firm Wiz tracked the Gheist campaign since September 15, noting it uses stolen GitHub tokens to steal secrets from over 850 compromised accounts. By October 24, about two-thirds of involved accounts were no longer available on GitHub, likely due to a response. The tool targets private repositories and GitHub Enterprise Server, bypassing safeguards that cover public repositories.