Technology
Wiz Research tracks Gheist campaign abusing stolen GitHub tokens across repositories
Hacker News reports that Wiz Research has tracked the Gheist campaign since September 2026 and recovered over 13,500 planted branches.
The short version
- Hacker News reports that Wiz Research has tracked the Gheist campaign since September 15, 2026.[Hacker News]
- Wiz Research reports recovering more than 13,500 planted branches from more than 850 compromised accounts, including enterprise private repositories.[Hacker News]
- Since July 28, 2026, GitHub has held potentially malicious workflow runs in public repositories until a collaborator approves them.[Hacker News]
Key facts
- Wiz Research has been tracking the Gheist campaign since September 15, 2026.[Hacker News]
- Wiz Research reports recovering more than 13,500 planted branches from more than 850 compromised accounts, including enterprise organizations' private repositories.[Hacker News]
- Since July 28, 2026, GitHub has held potentially malicious workflow runs in public repositories until a collaborator approves them.[Hacker News]
What remains uncertain
- The Gheist figures come from Wiz Research as relayed by Hacker News and have not been independently confirmed in the provided reporting. Basis: the only source article is a single Hacker News report.[Hacker News]
Sources
Outlet counts describe coverage, not independent confirmation. Reports may share a wire service or original source.