Gheist turns GitHub Actions into a secret extraction service

For Australian organisations, the software supply chain is no longer just a theoretical risk. With the recent rise of "Gheist," a threat actor targeting GitHub accounts, the automation tools we rely on to accelerate development are being weaponised against us.

Gheist has discovered an ingenious way to turn compromised GitHub accounts into credential harvesting platforms. By planting malicious GitHub Actions workflows within private repositories, they can exfiltrate sensitive environment variables and secrets before anyone notices. For an Australian business, this means your internal CI/CD pipelines could be leaking your cloud credentials, API keys, and customer data in real time.

How the attack works

The attack begins with the compromise of a developer’s GitHub account, typically via session hijacking or phishing. Once inside, the threat actor does not immediately exfiltrate data. Instead, they insert malicious YAML files into the .github/workflows directory of existing repositories.

These workflows are configured to trigger on common events like a push or a pull request. When the pipeline runs, the malicious action executes code that extracts environment variables stored within the repository's settings. These secrets, which often include AWS keys, Azure service principals, or database strings, are then sent to a remote server controlled by the attacker. Because the action runs as part of a legitimate build process, these exfiltrations often bypass traditional network-based monitoring.

The impact on Australian organisations

The primary impact is the loss of "crown jewel" credentials. Once an attacker has access to your cloud environment, they can pivot through your infrastructure, compromise production databases, or hold your data for ransom.

Furthermore, this attack is difficult to detect. Since the malicious actions are hidden inside private repositories, they are invisible to the public and often escape the notice of security teams who focus on perimeter defense rather than internal pipeline integrity. This aligns with the Australian Cyber Security Centre (ACSC) warnings about supply chain threats, where attackers leverage trusted development environments to gain a foothold.

Aligning with security best practices

To defend against Gheist, you must shift your mindset from securing the network to securing the identity and the pipeline. Relying solely on passwords is no longer enough. The ACSC recommends implementing phishing-resistant Multi-Factor Authentication (MFA), such as hardware security keys (FIDO2), which effectively stops session hijacking attempts.

Additionally, you should treat your CI/CD pipeline as a high-risk asset. If a workflow does not need access to your production secrets, it should not have them. Implementing the principle of least privilege ensures that even if a workflow is compromised, the attacker’s reach is limited to a small subset of non-critical data.

What you should do

To protect your organisation, take these steps immediately:

• Enforce Hardware MFA: Require FIDO2/WebAuthn security keys for all developers accessing your GitHub organisation.
• Audit Repository Workflows: Perform a one-time audit of all .github/workflows files across all repositories to identify any unfamiliar or suspicious YAML configurations.
• Implement Secret Scanning: Enable GitHub’s native secret scanning and push protection features to alert you if sensitive data is accidentally committed or exposed.
• Restrict Action Usage: Use GitHub’s organisation-level settings to restrict which Actions can be run, ideally allowing only verified actions from trusted publishers.
• Rotate Secrets: If you suspect an account has been compromised, perform an immediate rotation of all secrets, API keys, and certificates associated with that developer's scope.

Conclusion

The emergence of Gheist serves as a stark reminder that our automated processes are only as secure as the accounts that manage them. By hardening our authentication processes and maintaining strict oversight of our build pipelines, we can ensure that our development tools remain a source of innovation rather than an open door for attackers. Stay vigilant, audit your workflows, and prioritise identity security above all else.