70/100
Wiz Research recovered more than 13,500 planted branches from over 850 compromised GitHub accounts in a campaign it calls Gheist. The tool uses a stolen token to plant a workflow in every repository the token can access, prints repository secrets to logs, and downloads them, including from private repositories. Organisations should check for unexpected branches and workflows, review Actions logs, and rotate exposed tokens and repository secrets.