Dormant GitHub Accounts Help Attackers Blend In While Mapping Corporate Orgs

Summary

Datadog Security Labs has identified overlapping campaigns using dormant GitHub accounts and compromised OAuth/PATs to enumerate corporate GitHub organizations and repositories via the GitHub API. This technique, leveraging old accounts, helps attackers blend in with legitimate activity. While often targeting public data, some actors have successfully cloned private repositories, indicating a significant reconnaissance and potential data exfiltration risk.

Full text

Dormant GitHub Accounts Help Attackers Blend In While Mapping Corporate Orgs Ravie LakshmananJul 09, 2026Developer Security / Supply Chain Security Datadog Security Labs is warning of "several overlapping campaigns" that are systematically enumerating corporate GitHub organizations, repositories, and user accounts through the GitHub API. "Operators rely on automated scraping tooling with custom or legitimate-sounding user agents, leveraging GitHub 'ghost' accounts that are often years old, or compromised OAuth tokens and personal access tokens (PATs) from legitimate users," Julie Agnes Sparks, senior security engineer at Datadog, said. While the activity in most cases involves targeting public data, select instances have gone beyond public information enumeration to successfully clone private repositories. The campaign employs a mix of automated scanner tools, over 50 dormant accounts, and dozens of legitimate accounts that have had their personal access tokens (PATs) exposed unintentionally or compromised through some other method to facilitate the enumeration. What's notable about the "ghost" accounts is that they were created two to five years ago and intentionally left inactive for extended periods of time before weaponizing them to issue API traffic across multiple organizations. This technique is strategic as it aims to avoid raising any red flags and pass off the activity as legitimate, as opposed to creating new accounts and immediately using them for scraping. Because a large chunk of GitHub's API surface is reachable without authentication, the enumeration queries return the necessary data, while blending into normal API usage. Some of them include - Listing an organization's public repositories Walking a user's followers and following lists Enumerating gists, starred repos, and org memberships, and Running GraphQL queries against public objects This information can be used by a threat actor to conduct reconnaissance and programmatically map out an organization's GitHub-related activity, such as its public repositories, its members, who those members follow, and which projects they modify. Data access has been confirmed in a few scenarios, with the attackers taking steps to clone a private repository belonging to a single organization. "Individually, most of these requests are unremarkable. They hit public endpoints, authenticate cleanly or not at all, and return successful responses," Datadog said. "The concern lies in the aggregate: a group of accounts moving in sync across companies' GitHub organizations with versioned custom tooling iterating over weeks, and in the worst case, actors that stopped enumerating and started cloning." Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  API Security, Cloud security, Cyber Attack, Developer Security, GitHub, Reconnaissance, Supply Chain Security, Threat Intelligence ⚡ Top Stories This Week ThreatsDay: AI Compute Hijacking, Apple Email Flaw, BlueHammer Ransomware + 14 Stories Chrome Ad Blocker with 10M+ Installs Found with Dormant Script Injection Capability New DirtyClone Linux Kernel Flaw Lets Local Users Gain Root via Cloned Packets Amazon Q Developer Flaw Could Let Malicious Repos Run Code via MCP Configs New Linux pedit COW Exploit Enables Root Access by Poisoning Cached Binaries OpenAI Previews GPT-5.6 Sol With Restricted Access and Stronger Cyber Safeguards FBI Warns Russian Intelligence Hackers Target Signal Backup Recovery Keys Public PoC Released for Critical libssh2 CVE-2026-55200 Client-Side SSH Flaw Microsoft Removes 119 Edge Extensions That Hid Malware in Images and Fonts ⚡ Weekly Recap: Linux Kernel Flaws, AI Malware Tricks, Turla Backdoor, Infostealers and More Mustang Panda Uses Zoho WorkDrive as Command Channel in Indian Government Attacks WhatsApp is Finally Getting Usernames to Help Keep Phone Numbers Private Oracle E-Business Suite Flaw CVE-2026-46817 Actively Exploited in the Wild New BioShocking Attack Tricks AI Browsers Into Leaking User Credentials AirDrop and Quick Share Flaws Let Nearby Attackers Trigger Crashes and Bypass Checks 282 iOS AI Apps Leak API Keys and Open AI Proxy Access in Network Traffic Study GuardFall Exposes Open-Source AI Coding Agents to Decades-Old Shell Injection Risks Microsoft Warns Poisoned MCP Tool Descriptions Can Make AI Agents Leak Data RustDuck Botnet Rebuilds in Rust to Hijack Routers and Servers for DDoS ⭐ Featured Resources What 200+ Security Teams Reveal About Using IP Intelligence in 2026 Get Hands-On SANS Training for Today’s Cyber Defense and Offensive Security Challenges See What’s Really Exposed Across Your IT, OT, IoT, Cloud, and Mobile Assets Get Gartner’s Guide to AI Agent Supervision and Runtime Controls

Entities