githash docs

An automated campaign that uses stolen GitHub tokens to push a branch named ci-sync- plus six random characters to every repository the token can reach, committing .github/workflows/sync-check.yml as "ci: sync config" under the token owner's name. The workflow prints the environment and every secret, base32-encoded so GitHub's log masking misses them. The operator downloads the run's log through the API and deletes the run seconds later, so there is no attacker server. Repositories with deployment environments get a job matrix that exposes environment secrets, and since October 19 repositories with self-hosted runners also get a sync-host job that searches the runner host for tokens and cloud credentials. Wiz recovered more than 13,500 branches from more than 850 accounts. GitHub's approval hold stopped the runs in public repositories; private and Enterprise Server repositories were exploited.

references

• https://www.wiz.io/blog/gheist-attempted-scaled-abuse-of-stolen-github-tokens-stumbles

spread over time

Press play to watch the threat spread, or drag the slider to pick dates.

known-malicious hashes · 3