Threat actors have been using a clever tactic to systematically gather sensitive information about organizations and their users through the GitHub API, according to a recent report from Datadog. This reconnaissance campaign has been ongoing for several months, with multiple overlapping campaigns leveraging “ghost accounts” – dormant user accounts that were registered years ago but left untouched.
The attackers are exploiting the fact that a large share of the GitHub API surface is reachable without authentication, allowing them to gather publicly available data such as organization and repository information, user followers and following lists, gists, starred repositories, and org memberships. This information can be used to map an organization’s structure and identify potential vulnerabilities.
The ghost accounts being used in these campaigns were registered two to five years ago but have been left dormant until recently. They are using automated scanners and the abuse of leaked credentials to send API traffic to multiple organizations, often in bursts of 1-3 weeks. The requests themselves blend with normal traffic, making them difficult to detect.
In some cases, the attackers have escalated their reconnaissance by cloning discovered repositories, raising concerns about data exfiltration. One campaign even used inadvertently exposed tokens from legitimate GitHub users to target private repository commit paths from dozens of accounts over a short period.
Datadog notes that this type of enumeration rarely produces meaningful access inside an organization but rather serves as reconnaissance. However, in rare cases, the attackers have successfully exfiltrated data from targeted organizations.
To detect and prevent such malicious activity, Datadog recommends that defenders look for data exfiltration from private repositories and check logs for anomalous user agent behavior. They also suggest enabling GitHub audit log streaming, baselining user agents, proactively threat hunting, and developing detections unique to each organization.
This campaign highlights the importance of monitoring API traffic and being aware of normal activity in your environment. By keeping a close eye on user agent behavior and detecting anomalies, organizations can stay one step ahead of these types of attacks.
Source: SecurityWeek — 2026-07-11