Dormant GitHub Accounts Weaponized in Coordinated Corporate Reconnaissance Campaigns

Cybersecurity researchers at Datadog Security Labs have uncovered systematic campaigns using years-old dormant GitHub accounts to silently map corporate organizations — and in some cases clone private repositories — without triggering standard security alerts.

The findings reveal a sophisticated and patient threat operation that blends automated scraping with compromised credentials and deliberately aged fake accounts to conduct reconnaissance at scale across GitHub's API infrastructure. For security teams already stretched thin, this threat is particularly insidious because it exploits the appearance of normality at every stage.

How Attackers Use Ghost Accounts to Stay Invisible

At the heart of these campaigns is a deceptively simple but effective strategy: patience. Threat actors created GitHub accounts two to five years ago and left them completely inactive before activating them for malicious API traffic. By the time these "ghost" accounts begin querying corporate GitHub organizations, they carry the appearance of legitimate long-standing users.

Julie Agnes Sparks, senior security engineer at Datadog, described the approach in stark terms. "Operators rely on automated scraping tooling with custom or legitimate-sounding user agents, leveraging GitHub 'ghost' accounts that are often years old, or compromised OAuth tokens and personal access tokens (PATs) from legitimate users," Sparks said.

The campaign deploys over 50 dormant accounts alongside dozens of legitimate accounts whose personal access tokens were either unintentionally exposed or compromised through other methods. This combination gives attackers a layered and resilient infrastructure for sustained enumeration.

Because much of GitHub's API surface is accessible without authentication, attackers can extract significant organizational data without ever raising a flag. The queries themselves appear routine and indistinguishable from normal developer activity. Understanding how these threats are identified and tracked is critical — effective cyber threat intelligence strategies and frameworks provide the structured methodology needed to detect coordinated campaigns of this nature before they escalate.

The Ghost Account Lifecycle

What makes this tactic particularly effective is the deliberate investment in time. Creating accounts years in advance and leaving them dormant until needed demonstrates a level of operational planning that goes well beyond opportunistic attacks. These are calculated campaigns with defined objectives — and the lead time involved suggests well-resourced threat actors.

The layered use of both aged fake accounts and compromised legitimate credentials creates redundancy. If one vector is detected or blocked, the other continues operating undetected. This resilience is a hallmark of mature, organised threat operations.

What Data Is Being Harvested and Why It Matters

The scope of information being collected is extensive. Attackers are systematically querying public endpoints to build detailed profiles of corporate GitHub presences. Specific enumeration activities confirmed by Datadog include:

• Listing an organisation's public repositories
• Walking a user's followers and following lists
• Enumerating gists, starred repositories, and organisation memberships
• Running GraphQL queries against public objects

This data allows threat actors to programmatically map an organisation's entire GitHub activity — identifying its public repositories, members, the people those members follow, and the projects they actively modify. In the context of supply chain security, this kind of intelligence is extraordinarily valuable to adversaries planning targeted attacks.

When Reconnaissance Becomes Intrusion

In a handful of confirmed cases, the enumeration went further. Attackers moved beyond public data collection and successfully cloned private repositories belonging to at least one organisation. This escalation from reconnaissance to actual data access marks a significant threshold in the threat's severity.

Datadog captured the danger precisely: "Individually, most of these requests are unremarkable. They hit public endpoints, authenticate cleanly or not at all, and return successful responses. The concern lies in the aggregate: a group of accounts moving in sync across companies' GitHub organizations with versioned custom tooling iterating over weeks, and in the worst case, actors that stopped enumerating and started cloning."

The transition from passive observation to active exfiltration is not always visible in real time. By the time private repository cloning is detected — if it is detected at all — the damage may already be done.

The Supply Chain Security Implications for Businesses

This campaign arrives at a moment when software supply chain attacks are among the most consequential threats facing organisations. Much like the slow-burn infiltration that characterised the real-world SolarWinds breach, attackers are playing a long game, building intelligence before striking. Recognising the broader patterns of how organisational threat management and risk frameworks apply to these campaigns is essential for businesses looking to mount an effective defence.

The use of compromised OAuth tokens and PATs is particularly alarming for security teams. These credentials often end up exposed in public repositories, dotfiles, or CI/CD pipeline configurations. Once an attacker obtains a valid PAT, their activity becomes nearly indistinguishable from that of a legitimate developer.

The Business Risk Extends Beyond GitHub

The exposure does not stop at GitHub itself. Organisations that use GitHub to manage proprietary code, internal tooling, or infrastructure-as-code repositories face tangible risk if private repositories are cloned. Intellectual property theft, competitive intelligence gathering, and the seeding of future supply chain compromises are all plausible downstream consequences.

For legal and compliance teams, the campaign raises pointed questions about access governance. If legitimate user credentials are being harvested and reused without detection, existing audit and monitoring frameworks may be inadequate for the threat environment organisations now face. Security professionals should also be aware of how social engineering red flags and manipulation tactics are frequently used alongside technical compromises to harvest credentials — the two methods often work in tandem.

What Organisations Should Do Now

The Datadog Security Labs report underscores the need for continuous monitoring of API usage patterns rather than relying solely on individual request analysis. Threat detection must evolve to recognise coordinated behavioural patterns across accounts and time periods — not just isolated suspicious actions.

According to the GitHub documentation on token security, organisations can implement granular token permissions and expiration policies that significantly reduce the attack surface exposed by compromised credentials.

Organisations dependent on GitHub for software development should take the following steps without delay:

• Audit all active PATs and OAuth tokens immediately and revoke any credentials that appear in public repositories
• Implement anomaly detection for unusual API query volumes tied to your organisation's endpoints
• Review which internal repositories are unnecessarily accessible via compromised tokens
• Restrict third-party OAuth application permissions as a precautionary measure
• Establish baseline API usage profiles so that coordinated enumeration activity stands out against normal developer behaviour

The threat posed by dormant ghost accounts is not a distant or theoretical one. The accounts are already created. The infrastructure is already in place. For many organisations, the reconnaissance may already be underway.