Stolen GitHub tokens drain secrets from private repositories
This is a DailyCyber.News update, brought to you by BareMetalCyber.com, for Tuesday, October 27th, 2026.
An active campaign is using stolen GitHub tokens to extract secrets from private repositories. More than thirteen thousand five hundred malicious branches were recovered across over 850 compromised accounts. The attacker plants a workflow that encodes repository secrets, writes them into a run log, downloads that log through GitHub’s own A P I, and quickly deletes the evidence. Private repositories and self-hosted runners are exposed.
This activity can reach production credentials and cloud roles without contacting an outside server that defenders could simply block. Safeguards introduced for public repositories don’t apply in the same way to private repositories or GitHub Enterprise Server.
For leaders, the message is that private code storage isn’t a security boundary when valid tokens are stolen. For defenders, deleted workflows and branches don’t reverse the exposure. Reachable secrets still need to be rotated, and compromised tokens need to be revoked.
The larger lesson is that developer identities are privileged paths into cloud infrastructure. Hunt for ci-sync branches and the gheist user agent, then revoke affected tokens and rotate every reachable secret.
For the sources and the full Daily Cyber newsletter, visit DailyCyber.News.
