Since September 15, 2026, the Gheist campaign has been abusing stolen GitHub tokens to commit a malicious workflow named sync-check to accessible repositories. This workflow attempts to print repository secrets into logs, which are then exfiltrated via GitHub's API before the logs are deleted. The campaign has affected over 850 compromised accounts and more than 13,500 planted branches, impacting both personal and enterprise private repositories. GitHub's approval controls have prevented exploitation in public repositories, but private and enterprise repositories remain vulnerable. The campaign operates without a command-and-control server, uses the user agent 'gheist', and has multiple evolving variants. Approximately two-thirds of affected accounts have been removed by GitHub, likely as a response measure.