Datadog researchers have uncovered coordinated, multi-month campaigns abusing GitHub's API and reactivated 'ghost' accounts to map organizations, their developers, and repositories. Most activity exploits public API endpoints — including unauthenticated GraphQL and REST calls — making it nearly indistinguishable from legitimate traffic. Over 50 dormant accounts, inactive for 2–5 years, were reactivated to conduct reconnaissance while appearing trustworthy. Some campaigns went further, using stolen personal access tokens (PATs) to probe private repositories, and at least one case resulted in data exfiltration via Git cloning. Cofense data shows malicious campaigns against Git platforms have grown yearly since 2021, with 95% targeting GitHub. Defenders are advised to enable GitHub audit log streaming, baseline user agents, rotate PATs, and proactively threat hunt for anomalous API patterns.
