Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs

thehackernews.com Oct 26, 2026

Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs

Curated by Shubham · TechCapsules · Oct 26, 2026

AI-summarised brief · reviewed before publication

An automated campaign dubbed “Gheist” has been using stolen GitHub tokens to create malicious workflow files in private repositories and GitHub Enterprise environments. The tool opens a new branch named ci-sync‑, commits a workflow that prints every readable secret to the Actions log, downloads the log via the API, and then deletes the run. Wiz’s investigation, ongoing since September 15, identified over 13,500 such branches across more than 850 compromised accounts, ranging from personal projects to enterprise repos. GitHub’s safeguard that pauses suspicious runs only protects public repositories, leaving private and Enterprise Server instances exposed. The attack also leverages compromised AWS credentials to enumerate Secrets Manager, and a recent variant targets self‑hosted runners. As of October 24 the campaign remains active, with many compromised accounts already removed from GitHub.

💡 Why It Matters

· By exfiltrating secrets directly through GitHub’s own infrastructure, the attack bypasses traditional network defenses, giving attackers unfettered access to production credentials.

Capsules Cybersecurity

Read full article on thehackernews.com

PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity

Palo Alto Networks’ Unit 42 has withdrawn its earlier claim that a recent breach of a European government agency involved direct exploitation of the PHP2Shell flaws (CVE‑2026‑109618 and CVE‑2026‑109619). The firm now says the attackers leveraged a vulnerable PHP application but cannot confirm the initial access stemmed from those specific CVEs. Post‑exploitation activity included AI‑assisted commands that harvested password hashes, MFA tokens, and set up an NTLM‑relay tunnel for attempted Domain Admin escalation. Concurrently, CYFIRMA identified a low‑volume, rotating‑node scanning campaign linked to North Korea’s Lazarus Group, probing 216 unpatched PHP hosts across 12 countries and sectors. The scans, coordinated via a closed I2P channel, use Korean‑specific language and aim to shortlist targets for future exploit deployment.

💡 The blend of AI‑driven post‑exploitation and stealthy, globally dispersed scanning shows threat actors are maturing their toolchains to evade detection while preparing precise, high‑impact attacks.

thehackernews.com · Oct 26

Between alerts: What Attackers Do in the Spaces Ordinary Detection Misses

Security operations centers (SOCs) are inundated with isolated alerts that rarely reveal an attack’s full narrative. Network detection and response (NDR) platforms can stitch these alerts into a continuous timeline, exposing the stealthy steps attackers take between high‑severity events. Modern adversaries use AI to automate reconnaissance, leverage legitimate admin tools, and pace their activity to blend with normal traffic, often remaining undetected for days or weeks. Analysts focusing only on the triggering alert miss the chained behaviors that link initial access to later exfiltration. Correlating protocol‑aware network telemetry across DNS, LDAP, SMB, and other services uncovers these hidden sequences, allowing SOCs to investigate without overwhelming alert volumes. This integrated view also supports faster containment and reduces investigation fatigue for teams.

💡 By revealing the hidden choreography of low‑profile actions, organizations can stop breaches before data leaves the network, turning a reactive alert flood into a proactive defense.

thehackernews.com · Oct 26

Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations

Researchers at Huntress uncovered a Microsoft 365 token‑replay campaign that hijacked sign‑in sessions and replayed stolen access tokens to infiltrate 97 accounts across 79 organizations between July 14 and September 22, 2026. The attackers used an adversary‑in‑the‑middle login page to capture credentials and MFA codes, then harvested the resulting tokens and “sprayed” them at scale, achieving 497 successful sign‑ins from over 200,000 attempts traced to the 193.26.115.0/24 subnet. After gaining access, they added rogue authenticator apps and registered 48 fake Entra devices to maintain persistence, sometimes removing existing MFA within three hours. Hidden email rules were also deployed to delete or forward messages, and compromised mailboxes were used to send spam before Microsoft Entra ID Protection flagged the accounts as high risk. The operation originated from a Romanian IP linked to the AsyncRAT‑infected hosting provider 1337 Services GmbH, which has connections to previously seized RDP rental services.

💡 By bypassing MFA through token replay, the attack demonstrates a scalable method to subvert modern authentication, forcing organizations to rethink token‑validation and device‑registration safeguards.

thehackernews.com · Oct 26

uCreator Android Spyware Can Steal Telegram 2FA Passwords and Clone WeChat Accounts

A rent‑a‑spyware kit named uCreator embeds malicious code in counterfeit copies of Telegram and WeChat, allowing attackers to hijack accounts, steal Telegram two‑factor authentication passwords, and clone WeChat sessions. The kit’s Telegram module matches the Baohuo backdoor previously reported by Doctor Web, sharing the same namespace (com.ucreator.tgjar), C2 server and command set. Infections spread via sideloaded APKs, fake app‑store sites targeting Portuguese‑speaking Brazil and Indonesian users, and a container app called “Onion Box” that runs other apps inside it. By running with the victim app’s identity, the malware can query message databases, exfiltrate phone numbers, names and passwords, and conceal attacker sessions. Samples dated July 2026 still use an older hooking engine, but the threat persists across Android 16–17 devices, with victims reported in China, the United States, India, Brazil and Indonesia.

💡 By capturing clear‑text 2FA passwords, the kit bypasses Telegram’s strongest user protection, giving attackers full control over high‑value messaging accounts and the ability to silently monitor or commandeer communications.

thehackernews.com · Oct 26

Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes

Two critical vulnerabilities were discovered in Wasmtime, a WebAssembly runtime used as an embeddable library, allowing malicious modules to break out of the sandbox that isolates them. Both bugs reside in Cranelift, Wasmtime’s default compiler, and received CVSS scores of 9.9. One flaw (CVE‑2026‑115889) stems from 24‑bit value fields that overflow on large functions, causing type confusion; the other (CVE‑2026‑115893) affects ARM64 br_table handling, letting an out‑of‑range index jump to unintended code. Fixed releases (36.0.19, 48.0.7, 49.0.4, and 50.0.0) were issued on October 19‑20, but only supported LTS lines receive patches; older lines, including 24.x, remain vulnerable. Because Wasmtime is compiled into services that accept third‑party modules—such as Fastly’s Compute platform—any host that does not rebuild with the patched library is exposed to arbitrary code execution.

💡 Unpatched Wasmtime instances can let attackers run native code on servers that execute user‑supplied WebAssembly, turning a sandboxed service into a full‑system compromise.

thehackernews.com · Oct 26

Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on…

A security researcher disclosed a critical flaw in Tailscale SSH that allows a compromised device to obtain root access on any reachable server within the same mesh. The vulnerability, detailed in the “Tailworm” report published on October 25, requires Tailscale SSH to be configured for port forwarding and an attacker to already control a device permitted by the network’s access rules. Testing on Tailscale 1.104.2 and headscale 0.29.5 showed that an ordinary SSH session could hijack a root‑only socket, read the password file, replace sockets for command execution, and even capture enrollment keys to add malicious nodes—provided Tailnet Lock is disabled. Tailscale has acknowledged the issue, is working on a fix, and has not yet issued a CVE or advisory.

💡 The exploit turns a single foothold into rapid, password‑less root takeover across an entire private network, exposing organizations to immediate, uncontrolled lateral movement.