Gheist campaign plants secret-dumping workflows using stolen GitHub tokens

Since September 15, Wiz Research has tracked Gheist, a campaign that abuses compromised GitHub tokens to commit a `sync-check` workflow into every repository a token can reach. The workflow base32-encodes secrets so GitHub's masking fails, prints them to the run log, then downloads the log via the API and deletes the run seconds later. Over 13,500 branches across 850+ accounts were found. GitHub's approval hold stopped public repos, but private repos and Enterprise were exploited.