Wiz observed three Gheist-affected victims re-pushing commits modified with PolinRider loaders on October 19 and 20, providing a concrete overlap with malware the source identifies as DPRK-linked. Gheist itself is a broader automated campaign that uses stolen GitHub tokens to plant secret-dumping Actions workflows, retrieve encoded secrets through GitHub's API, and rapidly delete the runs. Public-repository executions were blocked by GitHub's approval control, while private and enterprise repositories experienced successful workflow execution and subsequent cloud-account activity. Wiz did not attribute Gheist to a DPRK actor and emphasized that compromised credentials were circulating among multiple distinct campaigns.