Stolen GitHub tokens used to plant secret-dumping workflows

Wiz Research describes an active campaign that used stolen GitHub tokens to add workflows across repositories and print accessible secrets into job logs. It found more than 13,500 planted branches linked to over 850 compromised accounts. GitHub’s approval hold stopped observed runs in public repositories, but Wiz reports successful activity in private repositories and GitHub Enterprise environments.

Wiz Research · Oct 25, 2026

Why it matters

Teams can check for suspicious branches and workflow runs, revoke compromised tokens, and rotate secrets that an affected workflow could access.

More context

Wiz recommends reviewing branches named ci-sync-* and audit records for quickly deleted workflow runs. It also advises checking cloud audit logs for credentials assumed from attacker-created branches, and restricting production secrets and OIDC trust to protected environments or branches.

Keep in mind

These findings and counts come from Wiz’s investigation and reflect activity through October 24. The campaign is evolving; consult the report for current indicators and response guidance.

Original read