Threat actors have been systematically scanning and mapping GitHub organizations, repositories, and user accounts using a network of dormant “ghost” accounts. The abuse of GitHub’s API has been ongoing for several months, with multiple overlapping campaigns using leaked credentials and automated scanners to gather information.
The activity, discovered by cybersecurity firm Datadog, involves exploiting publicly available data through the GitHub API. While this might seem harmless at first glance, the sheer scale and persistence of these requests raise concern. The attackers are not only targeting public repositories but also mapping organizations, their members, and the projects they access. In some cases, they have even cloned discovered repositories.
The ghost accounts used in this campaign were registered two to five years ago but remained dormant until now. This strategy allows the attackers to blend with normal traffic, making it harder to detect their activity. The requests themselves are targeting public paths, generating HTTP 200 responses and no authentication failure signals. This means that an attacker can use legitimate API traffic to gather sensitive information about an organization’s structure and member access.
Datadog notes that this enumeration rarely produces meaningful access inside an organization but is rather accomplishing reconnaissance. However, in rare cases, the attackers have moved beyond reconnaissance and successfully exfiltrated data from targeted organizations. One campaign was seen using inadvertently exposed tokens from legitimate GitHub users to target private repository commit paths.
To detect this type of malicious activity, defenders should look for data exfiltration from private repositories and check logs for anomalous user agent behavior. User agents, event activity, and actor names are vital clues to unauthorized activity in an environment. Datadog suggests enabling GitHub audit log streaming, baselining user agents, proactively threat hunting, and developing detections unique to the organization.
This campaign highlights the importance of monitoring API traffic and maintaining a strong security posture on platforms like GitHub. By staying vigilant and adapting to emerging threats, organizations can reduce their exposure to reconnaissance campaigns like this one. As the cybersecurity landscape continues to evolve, it’s essential for defenders to be proactive in identifying potential vulnerabilities and implementing effective countermeasures.
Practically speaking, users should review their API settings, ensure that sensitive data is not exposed, and regularly monitor their logs for suspicious activity. By taking these steps, organizations can better protect themselves against reconnaissance campaigns like this one.
Source: SecurityWeek — 2026-07-11