Stolen GitHub tokens drain secrets from private repositories

Show Notes

Daily Cyber News: Stolen GitHub tokens drain secrets from private repositories

An active campaign is using stolen GitHub tokens to extract secrets from private repositories. More than thirteen thousand five hundred malicious branches were recovered across over 850 compromised accounts. The attacker plants a workflow that encodes repository secrets, writes them into a run log, downloads that log through GitHub’s own A P I, and quickly deletes the evidence.

Key context: This activity can reach production credentials and cloud roles without contacting an outside server that defenders could simply block.

Additional detail: For leaders, the message is that private code storage isn’t a security boundary when valid tokens are stolen.

For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.

Topics: cybersecurity news, cybersecurity, cyber risk, Stolen GitHub, Stolen, GitHub, tokens, drain, secrets, private.

What is BMC Daily Cyber News?

The BCM Daily Cyber News brings you clear, timely updates on threats, breaches, patches, and trends every day. Stay informed in minutes with focused audio built for busy professionals. Learn more and explore at BareMetalCyber.com.

This is a DailyCyber.News update, brought to you by BareMetalCyber.com, for Tuesday, October 27th, 2026.

An active campaign is using stolen GitHub tokens to extract secrets from private repositories. More than thirteen thousand five hundred malicious branches were recovered across over 850 compromised accounts. The attacker plants a workflow that encodes repository secrets, writes them into a run log, downloads that log through GitHub’s own A P I, and quickly deletes the evidence. Private repositories and self-hosted runners are exposed.

This activity can reach production credentials and cloud roles without contacting an outside server that defenders could simply block. Safeguards introduced for public repositories don’t apply in the same way to private repositories or GitHub Enterprise Server.

For leaders, the message is that private code storage isn’t a security boundary when valid tokens are stolen. For defenders, deleted workflows and branches don’t reverse the exposure. Reachable secrets still need to be rotated, and compromised tokens need to be revoked.

The larger lesson is that developer identities are privileged paths into cloud infrastructure. Hunt for ci-sync branches and the gheist user agent, then revoke affected tokens and rotate every reachable secret.

For the sources and the full Daily Cyber newsletter, visit DailyCyber.News.