Threat actors have spent since October 2025 running coordinated reconnaissance across GitHub’s public API using more than 50 dormant “ghost” accounts, some registered two to five years ago and left idle until activation, according to a report from Datadog Security Labs. The campaign systematically enumerates organizations, repositories, and user accounts through unauthenticated GraphQL and REST endpoints, disguising requests with user agents made to look like analytics tools, dashboards, or legitimate data exfiltration platforms so the traffic blends into an organization’s normal API noise. In rare cases, Datadog found the reconnaissance escalated into actual repository cloning and data exfiltration once a promising target was identified.
On its own, an enumeration campaign like this rarely hands an attacker meaningful access. As Datadog put it, “on its own, this enumeration rarely produces meaningful access inside an organization, rather it’s accomplishing reconnaissance.” That framing is the point: this is a mapping exercise, building a target list of which organizations expose which repositories and which accounts belong to which teams, intelligence that becomes far more dangerous once combined with a leaked credential, a phished token, or a second-stage exploit. Datadog also observed leaked credential abuse layered into the same campaign, meaning at least some of the reconnaissance is already being paired with real access attempts rather than pure mapping.
The original insight for security leaders is that GitHub API reconnaissance sits in a genuine blind spot: it uses endpoints that do not require authentication, generates traffic that looks routine at the volume most organizations experience it, and rarely trips an alert built around failed logins or unusual repository access. CyberTech has previously covered how GitHub has had to patch trust-boundary flaws as AI agents expanded its platform attack surface, and this campaign extends that same theme to the API layer that underpins ordinary developer tooling. Datadog recommends enabling GitHub audit log streaming, baselining expected user agents, and watching specifically for anomalous agents accessing private repositories, since a dormant account suddenly enumerating an organization’s private repos is a signal worth hunting for before it becomes a credential-stuffing or targeted phishing campaign.
Source: Datadog Security Labs
