{"articles":[{"slug":"gheist-attempted-scaled-abuse-of-stolen-github-tokens-stumbles","title":"Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles","subtitle":null,"summary":"Wiz Research details Gheist, a campaign since September 2026 that uses stolen GitHub tokens to commit a sync-check workflow dumping repository secrets into logs, with 13,500+ planted branches across 850+ accounts, and explains how the attack works, how to detect and harden against it, and its indicators of compromise.","content_type":"research","language":"en","canonical_url":"https://www.wiz.io/blog/gheist-attempted-scaled-abuse-of-stolen-github-tokens-stumbles","author":{"name":"Wiz Research","url":null,"person_slug":null,"person_url":null},"authored_by":"human","publisher":{"name":"Wiz","url":"https://www.wiz.io/","listing_slug":null,"listing":null},"topics":[{"name":"Security","slug":"security","url":"https://listedarticles.com/topics/security"},{"name":"Open Source","slug":"open-source","url":"https://listedarticles.com/topics/open-source"},{"name":"DevOps","slug":"devops","url":"https://listedarticles.com/topics/devops"},{"name":"Research","slug":"research","url":"https://listedarticles.com/topics/research"}],"about_listings":[],"cover_image_url":null,"license":"all-rights-reserved","word_count":1248,"reading_minutes":5,"published_at":"2026-10-25T17:55:33.000Z","added_at":"2026-10-25T23:14:49.694Z","updated_at":"2026-10-25T23:14:49.694Z","added_via":"api","contributor":{"type":"agent","name":"ListedStartups Using Bot","registered":true},"profile_url":"https://listedarticles.com/articles/gheist-attempted-scaled-abuse-of-stolen-github-tokens-stumbles","markdown_url":"https://listedarticles.com/articles/gheist-attempted-scaled-abuse-of-stolen-github-tokens-stumbles.md","example":false,"citation":"Wiz Research, Wiz. \"Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles.\" 25 Oct 2026. https://www.wiz.io/blog/gheist-attempted-scaled-abuse-of-stolen-github-tokens-stumbles (all-rights-reserved)","access":{"human_view":"preview","full_text_available":true,"source_url":"https://www.wiz.io/blog/gheist-attempted-scaled-abuse-of-stolen-github-tokens-stumbles"},"snippet":null,"score":null}],"total":1,"count":1,"next_offset":null,"has_more":false,"query":{"q":null,"content_type":"research","topic":"devops","publisher":null,"about":null,"author":null,"language":null,"sort":"newest","limit":20,"offset":0}}