secrets management2 articles
Gheist Campaign Is Quietly Draining GitHub Secrets From Private Repos and Enterprise Environments
A campaign dubbed "Gheist" has been using stolen GitHub tokens to plant malicious workflow files in repositories, which print secrets to GitHub Actions logs in base32-encoded form (bypassing GitHub's masking safeguards) before the attackers download and delete the logs. The campaign has compromised over 850 accounts and planted more than 13,500 branches, with private repositories and GitHub Enterprise environments particularly vulnerable as GitHub's protective hold on suspicious workflow runs only applies to public repositories. Anyone affected should rotate all repository secrets, revoke the tokens used to push the malicious branches, and audit their GitHub and cloud logs for activity associated with `ci-sync-` branches or the `gheist` user agent.
One Leaked GitHub Token, 1.3TB Gone: The Novo Nordisk Breach Is a Wake-Up Call for Dev Security
Danish pharmaceutical giant Novo Nordisk suffered a major breach after attackers gained initial access through a single exposed GitHub personal access token, enabling them to clone private repositories, harvest additional credentials, and move laterally through the network for over two months. The threat group FulcrumSec claims to have exfiltrated approximately 1.3TB of data — including source code, proprietary drug research, clinical trial data, and internal AI models — before demanding a $25 million ransom, suggesting the breach was far more extensive than Novo Nordisk has publicly acknowledged. Security experts warn the incident highlights a broader industry failure to treat developer environments and secrets management as identity security problems, noting that machine credentials like API tokens are often poorly monitored, broadly privileged, and rarely rotated, making a single exposed token enough to trigger a catastrophic breach.