--- title: GitHub’s public APIs are becoming an enterprise... description: Datadog Security Research has identified a sustained campaign abusing GitHub's public APIs and dormant 'ghost' accounts to map enterprise software... canonical: https://daily.dev/posts/github-s-public-apis-are-becoming-an-enterprise-reconnaissance-tool-ty1kvhyvy twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: GitHub’s public APIs are becoming an enterprise reconnaissance tool | daily.dev og:description: Datadog Security Research has identified a sustained campaign abusing GitHub's public APIs and dormant 'ghost' accounts to map enterprise software... og:url: https://daily.dev/posts/github-s-public-apis-are-becoming-an-enterprise-reconnaissance-tool-ty1kvhyvy og:image: https://api.daily.dev/og/posts/Ty1KvHyVy.png og:image:alt: GitHub’s public APIs are becoming an enterprise reconnaissance tool og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # GitHub’s public APIs are becoming an enterprise reconnaissance tool **[InfoWorld](https://daily.dev/sources/infoworld)** · 5 min read · 0 upvotes · 0 comments ## Summary Datadog Security Research has identified a sustained campaign abusing GitHub's public APIs and dormant 'ghost' accounts to map enterprise software environments, their members, and repositories. Attackers use unauthenticated API requests — particularly against the GraphQL endpoint — with custom scraping tools that mimic normal developer traffic, making detection difficult. Ghost accounts aged two to five years are activated in short bursts across many enterprises simultaneously. Some campaigns also exploit leaked OAuth tokens and PATs from compromised developer accounts. Defenders are advised to monitor GitHub audit logs for unusual user agent patterns, enable audit log streaming, baseline normal API activity, enforce MFA, and scan repositories for plaintext credentials. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How are attackers using GitHub's public APIs to reconnaissance enterprise organizations? Attackers exploit GitHub's unauthenticated public API surface to build detailed maps of organizations, their public repositories, members, followers, starred repos, and project interactions. Requests return standard HTTP 200 responses and blend into normal API traffic. Datadog researchers found this run via dormant 'ghost' accounts two to five years old plus compromised legitimate accounts, using tools like GitHub-Company-Scraper against GraphQL and REST endpoints in short weekly bursts across many enterprises. _Security teams tracking GitHub API abuse patterns can follow ongoing threat research on daily.dev._ ### What are GitHub ghost accounts and why do attackers use them for scraping? Ghost accounts are GitHub profiles created two to five years ago and left dormant before being activated for scraping campaigns. An account with a multi-year history appears more legitimate than one registered the same week it starts scraping, helping attackers evade suspicion. Researchers identified more than 50 such accounts clustered into families with names like user432023 or kobalt*, each used for one-to-three-week bursts across many organizations before going silent again. _Anyone hardening GitHub org security can track detection techniques for account-based abuse on daily.dev._ ### What can enterprises do to detect and prevent GitHub API reconnaissance attacks? Enterprises should enable GitHub audit log streaming, baseline normal user agent behavior, and perform proactive threat hunting tailored to their own organization rather than relying on generic signatures. Key fields to monitor include user agent, token type, autonomous system number, and attempted action. Additional best practices include enforcing MFA on all accounts, conducting periodic access reviews, removing unused accounts, and scanning repos for plaintext credentials. _Teams building GitHub security monitoring can compare detection strategies and best practices on daily.dev._ ## Similar posts on daily.dev - [GitHub API Abuse, ‘Ghost’ Accounts Part of Malicious Efforts to Map Organizations](https://daily.dev/posts/github-api-abuse-ghost-accounts-part-of-malicious-efforts-to-map-organizations-bsffbfs4m) · DevOps.com · 0 upvotes · 0 comments - [GitHub Secret Scanning Public Monitoring for Enterprises: Coverage and Gaps](https://daily.dev/posts/github-secret-scanning-public-monitoring-for-enterprises-coverage-and-gaps-txomrmpk3) · StepSecurity · 3 upvotes · 0 comments - [Secret scanning public monitoring for enterprises](https://daily.dev/posts/secret-scanning-public-monitoring-for-enterprises-v2pkpwqj5) · GitHub Changelog · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#github](https://daily.dev/tags/github), [#secrets-management](https://daily.dev/tags/secrets-management) [View this post on daily.dev](https://daily.dev/posts/github-s-public-apis-are-becoming-an-enterprise-reconnaissance-tool-ty1kvhyvy) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"GitHub’s public APIs are becoming an enterprise reconnaissance tool","url":"https://daily.dev/posts/github-s-public-apis-are-becoming-an-enterprise-reconnaissance-tool-ty1kvhyvy","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/github-s-public-apis-are-becoming-an-enterprise-reconnaissance-tool-ty1kvhyvy"},"datePublished":"2026-07-08T23:06:18.553Z","dateModified":"2026-09-14T09:08:13.813Z","description":"Datadog Security Research has identified a sustained campaign abusing GitHub's public APIs and dormant 'ghost' accounts to map enterprise software...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/55c2a1a54c04f617c75341a9a93141e0?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/55c2a1a54c04f617c75341a9a93141e0?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"InfoWorld","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"InfoWorld","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/bf6d68a999064029b0bb09aa6268f1f3","url":"https://daily.dev/sources/infoworld"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/github-s-public-apis-are-becoming-an-enterprise-reconnaissance-tool-ty1kvhyvy","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,github,secrets-management","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"InfoWorld","item":"https://daily.dev/sources/infoworld"},{"@type":"ListItem","position":3,"name":"GitHub’s public APIs are becoming an enterprise reconnaissance tool"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/github-s-public-apis-are-becoming-an-enterprise-reconnaissance-tool-ty1kvhyvy#faq","mainEntity":[{"@type":"Question","name":"How are attackers using GitHub's public APIs to reconnaissance enterprise organizations?","acceptedAnswer":{"@type":"Answer","text":"Attackers exploit GitHub's unauthenticated public API surface to build detailed maps of organizations, their public repositories, members, followers, starred repos, and project interactions. Requests return standard HTTP 200 responses and blend into normal API traffic. Datadog researchers found this run via dormant 'ghost' accounts two to five years old plus compromised legitimate accounts, using tools like GitHub-Company-Scraper against GraphQL and REST endpoints in short weekly bursts across many enterprises. Security teams tracking GitHub API abuse patterns can follow ongoing threat research on daily.dev."}},{"@type":"Question","name":"What are GitHub ghost accounts and why do attackers use them for scraping?","acceptedAnswer":{"@type":"Answer","text":"Ghost accounts are GitHub profiles created two to five years ago and left dormant before being activated for scraping campaigns. An account with a multi-year history appears more legitimate than one registered the same week it starts scraping, helping attackers evade suspicion. Researchers identified more than 50 such accounts clustered into families with names like user432023 or kobalt*, each used for one-to-three-week bursts across many organizations before going silent again. Anyone hardening GitHub org security can track detection techniques for account-based abuse on daily.dev."}},{"@type":"Question","name":"What can enterprises do to detect and prevent GitHub API reconnaissance attacks?","acceptedAnswer":{"@type":"Answer","text":"Enterprises should enable GitHub audit log streaming, baseline normal user agent behavior, and perform proactive threat hunting tailored to their own organization rather than relying on generic signatures. Key fields to monitor include user agent, token type, autonomous system number, and attempted action. Additional best practices include enforcing MFA on all accounts, conducting periodic access reviews, removing unused accounts, and scanning repos for plaintext credentials. Teams building GitHub security monitoring can compare detection strategies and best practices on daily.dev."}}]} ```