Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles
// AI summary
Gheist, an automated campaign using stolen GitHub tokens, attempted to plant secret-dumping workflows in reachable repositories but was significantly disrupted by recent GitHub security improvements.
// from the source
An automated campaign is planting secret-dumping workflows in every repository that stolen GitHub tokens can reach. It uses no C2 server, is actively evolving, and has been significantly disrupted by recent GitHub security improvements.