Dormant GitHub ghost accounts used for mass API reconnaissance

Datadog reports that since at least October 2025 more than 50 dormant GitHub accounts, created two to five years earlier and left inactive, were used to send bursts of API requests to enumerate organizations, repositories and user accounts.

The activity occurred across several overlapping campaigns and relied on automated scanners, leaked credentials and coordinated networks of aged accounts. Requests typically arrived in bursts that lasted one to three weeks. Most traffic targeted GitHub’s GraphQL endpoints, with additional calls to REST routes.

Many of the API paths returned public data and delivered HTTP 200 responses, allowing the requests to blend with normal API traffic and avoid generating authentication-failure alerts.

Attackers used public API responses to list public repositories, walk follower and following lists, enumerate gists, check starred repositories and organization memberships, and run GraphQL queries against public objects. In most observed cases the behavior amounted to reconnaissance.

Datadog also observed campaigns that escalated. Some actors cloned discovered repositories and, in a small number of cases, exfiltrated data from private projects. One campaign used inadvertently exposed personal access tokens from legitimate users to access private repository commit paths; dozens of valid accounts were used within minutes during that activity.

Many of the ghost accounts set user-agent strings designed to resemble analytics, dashboard or data-transfer tools.

Datadog wrote: “A large share of GitHub’s API surface is reachable without authentication.” The report added that user-agent strings, event activity and actor names provide important clues to unauthorized activity.

To detect and respond to similar activity, Datadog recommends monitoring for data leaving private repositories, inspecting logs for unusual user-agent behavior and odd naming or versioning in requests that touch private resources, enabling GitHub audit log streaming, baselining normal API behavior, conducting proactive threat hunting and developing detections specific to an organization’s GitHub footprint.

Organizations that host code, manage contributors or integrate third-party services on GitHub may expose project structure, member roles and other details that can be mapped when credentials or tokens are exposed.