Dormant GitHub Accounts Wake Up for Mass Recon Campaign

Somebody has been playing a very long game on GitHub. Researchers at Datadog have identified more than 50 ghost accounts, all registered two to five years ago and left completely idle since, that recently sprang to life to run reconnaissance against the GitHub API. The activity has been running for months, in bursts of one to three weeks, spread across multiple organisations.

Why it looks like nothing

The uncomfortable part is that almost none of the traffic looks wrong. A huge slice of GitHub's API can be queried with no authentication at all. Listing an organisation's public repositories, walking through its members, checking who follows whom, pulling starred repos and gists, running GraphQL queries against public objects: every one of those returns a clean HTTP 200. There are no failed logins to alert on, no lockouts, no odd error patterns. Just a slow, methodical map of who works where and what they care about.

Most of the requests went through GraphQL, with a smaller share hitting REST routes. The accounts used user agent strings crafted to sound like inoffensive analytics or dashboard tooling, the kind of noise most defenders would ignore without a second glance.

The token strand

One thread of the campaign went further than passive recon. The attackers picked up tokens that real GitHub users had accidentally leaked, then used them to hit private repository commit paths across dozens of accounts inside a few minutes. In a small number of cases, they actually pulled data out.

Leaked tokens remain one of the softest ways into a modern engineering environment. They sit in old commits, in build logs, in screenshots pasted into support tickets. Once they are out, they behave exactly like the developer who created them, which is why token abuse rarely trips anything until well after the fact.

Why anyone would bother

Reconnaissance on its own rarely gets anyone inside anything. What it does is tell an attacker exactly where to push next. Which developers matter. Which projects look interesting. Which side accounts might have weaker hygiene, older devices, more forgiving MFA settings. Given a good enough map, the follow-up phishing or social engineering campaign writes itself. That is where months of quiet API calls turn into a very specific email landing in a very specific inbox.

What Datadog suggests

The practical advice from the research is worth taking on board if your organisation lives on GitHub:

• Turn on audit log streaming so you have visibility beyond the default retention window.
• Learn what your normal user agents look like, then flag anything that pretends to be analytics tooling but does not match your stack.
• Build detections around private repository access, especially odd commit paths, strange naming and unusual versioning behaviour.
• Treat leaked tokens with the same seriousness as leaked passwords, because that is functionally what they are.

The wider point sits underneath all of this. When the reconnaissance layer is silent by design, defenders end up needing to know their own environment well enough to notice when someone else is quietly learning it too.