Datadog Reports Dormant GitHub Accounts Used for Large-Scale API Reconnaissance
Summary
Datadog reports that more than 50 dormant GitHub accounts have been used since at least October 2025 to enumerate public organizations and repositories. Some activity abused exposed tokens to target private repositories; Datadog says data was exfiltrated in rare cases.
Key points
- Datadog reports overlapping campaigns using dormant accounts registered two to five years earlier to enumerate GitHub organizations, repositories, and users.
- Since at least October 2025, more than 50 accounts have sent API traffic, typically in bursts lasting one to three weeks across multiple organizations.
- Most requests targeted GraphQL, with others aimed at REST routes. Public API responses let operators map organizations, members, and projects without authentication-failure signals.
- One campaign used inadvertently exposed tokens from legitimate users to target private-repository commit paths across dozens of accounts over several minutes.
- Datadog says the activity was usually reconnaissance, but in rare cases attackers went further and exfiltrated data from targeted organizations.
- Datadog recommends streaming GitHub audit logs, baselining user agents, threat hunting, and checking for anomalous user-agent activity and private-repository data exfiltration.
Article Details
- Event Type
- Ongoing reconnaissance campaign abusing dormant GitHub accounts and the GitHub API to enumerate organizations, repositories, and user accounts.
- Impact
- Datadog reports that attackers used over 50 dormant accounts and, in one campaign, inadvertently exposed tokens from legitimate GitHub users to target private repository commit paths. In rare cases, attackers reportedly cloned repositories and exfiltrated data from targeted organizations.