Dormant GitHub ‘Ghost’ Accounts Used in Coordinated Reconnaissance Campaigns

Datadog Security Labs has uncovered several overlapping campaigns that leverage dormant GitHub accounts—some created two to five years ago—to systematically enumerate corporate GitHub organizations, repositories, and user accounts via the GitHub API. The activity, detailed by senior security engineer Julie Agnes Sparks, relies on automated scraping tools with custom or legitimate-sounding user agents, along with compromised OAuth tokens and personal access tokens (PATs) from legitimate users.

While most targeting involves public data, select instances have escalated to successfully cloning private repositories. The campaigns employ over 50 dormant ‘ghost’ accounts and dozens of compromised legitimate accounts. Attackers intentionally leave these accounts inactive for extended periods before weaponizing them to issue API traffic across multiple organizations, a tactic designed to avoid detection and blend into normal usage.

Because much of GitHub’s API surface is accessible without authentication, enumeration queries—such as listing public repositories, walking follower/following lists, enumerating gists and starred repos, and running GraphQL queries—return necessary data while appearing unremarkable. This reconnaissance enables threat actors to map an organization’s GitHub activity, including members, their connections, and project modifications.

Datadog confirmed data access in a few scenarios where attackers cloned private repositories. The concern lies in the aggregate: coordinated accounts moving in sync across organizations with versioned custom tooling over weeks, and in worst cases, shifting from enumeration to cloning. The findings underscore the need for organizations to monitor API usage patterns and review dormant account activity.