Attackers are using years-old GitHub accounts that never posted a single thing to quietly map out corporate infrastructure. And it’s working.
Datadog Security Labs is tracking “several overlapping campaigns” systematically scraping corporate GitHub orgs, repos, and user accounts through the GitHub API. The operators aren’t brute-forcing anything. They’re using “ghost” accounts — profiles created two to five years ago, left inactive, then suddenly woken up to issue API calls across multiple orgs.
Why old accounts? Because a fresh account scraping thousands of API endpoints looks suspicious. An account from 2022 that’s been dormant for years? That blends right in.
The attackers also use compromised OAuth tokens and personal access tokens (PATs) from actual employees. Most of the data they’re grabbing is public — but that’s still valuable for reconnaissance. In some cases, they went further and cloned private repos.
A lot of GitHub’s API is accessible without authentication. Attackers are listing public repos, walking follower networks, enumerating gists and starred repos, and running GraphQL queries against public objects. Each individual request looks boring. It’s the aggregate pattern — multiple accounts moving in sync across companies — that reveals what’s really happening.
Datadog puts it well: the concern isn’t that one request looks bad. It’s that these accounts keep going, iterating over weeks, and some of them stop enumerating and start cloning.
