'Gheist' Weaponizes GitHub Tokens to Steal Cloud Secrets
2026-10-26T20:51:32Z•1b7defde396a7c0ab4c5742f36df12d3ab5d958603458ff25f08a9956c07965f
AI-assisted-attacksClickFixConnectWiseGitHub-tokensMicrosoft-365OT-securityPHPcertificate-compromisecloud-secretscredential-theftdata-breachinsider-threatransomwarerepository-compromisesocial-engineeringspywaresupply-chain-attackthreat-intelligencevulnerability-exploitation
What happened
Dark Reading feed covering active cyber threats, including supply-chain compromises, credential and cloud-secret theft, exploitation of critical vulnerabilities, AI-assisted attacks, social engineering, data breaches, ransomware, insider threats, and OT security incidents. The most prominent item describes the ongoing 'Gheist' campaign harvesting GitHub tokens to access developer repositories and cloud secrets, while related reporting highlights PHP vulnerabilities, ConnectWise and GitHub compromises, and automated attacks against large numbers of organizations.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- darkreading
- Record identifier
- 1b7defde396a7c0ab4c5742f36df12d3ab5d958603458ff25f08a9956c07965f
- Enrichment time
- 2026-10-26T20:51:32Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.