Gheist uses stolen GitHub tokens to extract secrets through Actions logs, planting over 13,500 branches across 850 compromised accounts.