Gheist Turns Stolen GitHub Tokens Into Secret Dumps via Actions Logs
Wiz says the Gheist campaign used stolen GitHub tokens to plant 13,500+ branches across 850+ accounts, each running a workflow that dumps repository secrets into Actions logs and deletes the run.