Skip to navigation

Threat reportSupply ChainTL-2026-1399

Coordinated GitHub API Enumeration and Access Token Abuse Campaign (Ghost Accounts + Compromised PAT/OAuth Tokens)

mediumACTIVE

Datadog Security Labs identified multiple overlapping, coordinated campaigns abusing the legitimate GitHub REST and GraphQL APIs to systematically enumerate organizations, repositories, users, and developer activity at scale. Operators use 50+ dormant 'ghost' accounts (created 2-5 years prior, then activated for 1-3 week bursts) alongside compromised Personal Access Tokens (PATs) and OAuth tokens to blend reconnaissance traffic into normal developer usage, and in at least one confirmed instance succeeded in cloning a private repository.

Key facts for GitHub ghost account recon

IdentifiersTL-2026-1399
SeverityMEDIUM
Exploitation statusExploited in the wild
Affected productsGitHub GitHub.com REST API and GraphQL API
MITRE ATT&CK techniquesT1036 Masquerading, T1078 Valid Accounts, T1087 Account Discovery, T1119 Automated Collection, T1213 Data from Information Repositories, T1526 Cloud Service Discovery, T1550 Use Alternate Authentication Material, T1552 Unsecured Credentials, T1567 Exfiltration Over Web Service, T1580 Cloud Infrastructure Discovery, T1583 Acquire Infrastructure, T1585 Establish Accounts and 6 more in the attack flow
MotivationUNKNOWN
Detection rules9 (1 shown free)
Sources9 cited sources

Detection coverage for GitHub ghost account recon

As of 2026-07-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1399 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: GitHub Scraper User-Agent Enumeration Burst (SPL)

Detects a single actor/token issuing a high-volume burst of GitHub REST/GraphQL requests using known disguised scraper user agents (GitHub-Repo-Crawler, gh-repo-lister, GitHub-Company-Scraper, GitHub-Scraper-Tool, repo-dumper, githarvester, GitHubAnalytics, GitHubDashboard, GitHub-Monitor, GitHubMetrics, GitHub-Insights, RepoAnalyzer, GitHub-Commit-Fetcher, GitHub-Event-Fetcher, gha-injection-scanner) against organization/repository/user/follower/gist/starred endpoints — the reconnaissance signature of the ghost-account and token-abuse campaigns.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1593, T1594, T1119
  • Data sources: github_audit_log, github_rest_api_logs, github_graphql_api_logs
  • Severity: high
  • Confidence: high

Splunk SPL

index=github_audit sourcetype="github:audit:log"
| eval scraper_ua=case(
    match(user_agent, "(?i)GitHub-Repo-Crawler"), 1,
    match(user_agent, "(?i)gh-repo-lister"), 1,
    match(user_agent, "(?i)GitHub-Company-Scraper"), 1,
    match(user_agent, "(?i)GitHub-Scraper-Tool"), 1,
    match(user_agent, "(?i)repo-dumper"), 1,
    match(user_agent, "(?i)githarvester"), 1,
    match(user_agent, "(?i)GitHubAnalytics"), 1,
    match(user_agent, "(?i)GitHubDashboard"), 1,
    match(user_agent, "(?i)GitHub-Monitor"), 1,
    match(user_agent, "(?i)GitHubMetrics"), 1,
    match(user_agent, "(?i)GitHub-Insights"), 1,
    match(user_agent, "(?i)RepoAnalyzer"), 1,
    match(user_agent, "(?i)GitHub-Commit-Fetcher"), 1,
    match(user_agent, "(?i)GitHub-Event-Fetcher"), 1,
    match(user_agent, "(?i)gha-injection-scanner"), 1,
    true(), 0)
| where scraper_ua=1
| bucket _time span=10m
| stats count as request_count, dc(action) as distinct_actions, values(action) as actions, values(repo) as repos_touched by _time, actor, user_agent, src_ip
| where request_count >= 25
| sort - request_count

Microsoft KQL

GitHubAuditLogPolling_CL
| where TimeGenerated > ago(24h)
| where UserAgent_s has_any ("GitHub-Repo-Crawler", "gh-repo-lister", "GitHub-Company-Scraper", "GitHub-Scraper-Tool", "repo-dumper", "githarvester", "GitHubAnalytics", "GitHubDashboard", "GitHub-Monitor", "GitHubMetrics", "GitHub-Insights", "RepoAnalyzer", "GitHub-Commit-Fetcher", "GitHub-Event-Fetcher", "gha-injection-scanner")
| summarize RequestCount = count(), DistinctActions = dcount(Action_s), Actions = make_set(Action_s), Repos = make_set(Repo_s) by bin(TimeGenerated, 10m), Actor_s, UserAgent_s, ActorIp_s
| where RequestCount >= 25
| project TimeGenerated, Actor_s, UserAgent_s, ActorIp_s, RequestCount, DistinctActions, Actions, Repos
| sort by RequestCount desc

Sigma

title: GitHub API Scraper User-Agent Enumeration Burst
id: 6a7cf8e0-1b3f-4a2e-9c1e-7f0d9e5a1c11
status: experimental
description: Detects a burst of GitHub REST/GraphQL API requests from a known or disguised scraper user agent used in the Datadog-tracked coordinated GitHub API enumeration and token-abuse campaign.
references:
    - https://securitylabs.datadoghq.com/articles/coordinated-github-api-enumeration/
    - https://thehackernews.com/2026/07/dormant-github-accounts-help-attackers.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-16
tags:
    - attack.reconnaissance
    - attack.t1593
    - attack.t1594
    - attack.t1119
    - attack.tool.repo_dumper
logsource:
    product: github
    category: audit_log
detection:
    selection:
        user_agent|contains:
            - 'GitHub-Repo-Crawler'
            - 'gh-repo-lister'
            - 'GitHub-Company-Scraper'
            - 'GitHub-Scraper-Tool'
            - 'repo-dumper'
            - 'githarvester'
            - 'GitHubAnalytics'
            - 'GitHubDashboard'
            - 'GitHub-Monitor'
            - 'GitHubMetrics'
            - 'GitHub-Insights'
            - 'RepoAnalyzer'
            - 'GitHub-Commit-Fetcher'
            - 'GitHub-Event-Fetcher'
            - 'gha-injection-scanner'
    timeframe: 10m
    condition: selection | count() by actor > 25
falsepositives:
    - Legitimate internal analytics/dashboard tooling that happens to reuse one of these user-agent strings (rename internal tools to avoid collision)
level: high

Known false positives:

  • Legitimate internal analytics, dashboard, or CI tooling that reuses one of the flagged user-agent strings without renaming it

Tuning notes: Baseline per-organization legitimate automation user agents (CI bots, internal dashboards) and allowlist them explicitly; lower the 25-request/10m threshold for smaller organizations with low baseline API volume.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • GraphQL Bulk-Enumeration Query Volume Spike (KQL) · unlock with TL Creds
  • Compromised Token Access from Non-Baseline IP/ASN or Masqueraded User Agent (KQL) · unlock with TL Creds
  • Versioned Custom Scraper Tool Iteration Against Org/Repo Endpoints (KQL) · unlock with TL Creds
  • GitHub Ghost Account Cluster Naming Pattern Match (Sigma) · unlock with TL Creds
  • Follower/Following/Gist/Starred-Repo Social-Graph Enumeration Sweep (Sigma) · unlock with TL Creds
  • Unsuccessful Private-Repository Access Attempts by Compromised Token (Sigma) · unlock with TL Creds
  • Dormant GitHub Account Sudden Activity Burst (SPL) · unlock with TL Creds
  • Private Repository Clone/ZIP-Download via Anomalous Token Access (SPL) · unlock with TL Creds

Indicators of compromise for GitHub ghost account recon

As of 2026-07-16, Threadlinqs Intelligence tracks 25 indicators of compromise for TL-2026-1399.

Sample indicators (2 of 25)

  • Domain: 3xktech[.]cloud
  • Domain: cherryservers[.]com

Defanged, TLP:CLEAR. Full set of 25 indicators: unlock with TL Creds.

25 indicators of compromise · unlock with TL Creds. Compare plans

How GitHub ghost account recon works

Between at least October 2025 and July 2026, Datadog Security Labs tracked several distinct but overlapping campaigns abusing GitHub's public REST API and GraphQL endpoint for mass reconnaissance. The operators registered or acquired GitHub accounts years in advance (2-5 years of dormancy observed across 50+ 'ghost' accounts) and left them inactive to avoid triggering new-account risk signals, later activating them in short 1-3 week operational bursts to query organization, repository, user, follower/following, gist, and starred-repo data. A second, distinct sub-campaign observed between late December 2025 and early January 2026 relied on compromised Personal Access Tokens (classic and fine-grained) and OAuth tokens harvested from legitimate developers, using a versioned progression of custom scraping tools (GitHub-Commit-Fetcher/1.3 -> 1.4 -> GitHub-Event-Fetcher/2.2) hosted on infrastructure at 3xktech[.]cloud, a hosting provider with a history of abuse reports. The heaviest concentration of traffic hit GitHub's /graphql endpoint, which is well suited to bulk queries across organizations, repositories, and users, alongside REST routes for organization repo listings and user profile/social-graph enumeration. While the bulk of the activity targeted public repositories and metadata, Datadog confirmed that in at least one case an account using the 'repo-dumper' user agent successfully accessed and cloned a private repository via a mix of git.clone and api.request events, indicating the token-holder's access scope included private resources. A parallel token-compromise sub-campaign attempted private-repository access but its probes returned unsuccessful (non-2xx) responses. No malware payload, exploit, or CVE is associated with this campaign; the technique is entirely an abuse of legitimate GitHub API functionality and valid credentials rather than a software vulnerability. The campaigns are unattributed and appear to represent multiple independent operators rather than a single actor, given the divergent tooling, infrastructure, and account patterns observed. The primary risk is intelligence-gathering on organizational structure, developer identities, and codebase contents, with a secondary supply-chain risk where private-repository access could expose proprietary source code, embedded secrets, or CI/CD configuration to downstream compromise.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1036 Masquerading; T1078 Valid Accounts

Initial Access

T1078 Valid Accounts

Discovery

T1087 Account Discovery; T1526 Cloud Service Discovery; T1580 Cloud Infrastructure Discovery; T1619 Cloud Storage Object Discovery

Collection

T1119 Automated Collection; T1213 Data from Information Repositories

lateral-movement

T1550 Use Alternate Authentication Material

Credential Access

T1552 Unsecured Credentials

Exfiltration

T1567 Exfiltration Over Web Service

Resource Development

T1583 Acquire Infrastructure; T1585 Establish Accounts; T1586 Compromise Accounts; T1588 Obtain Capabilities

Reconnaissance

T1589 Gather Victim Identity Information; T1593 Search Open Websites/Domains; T1594 Search Victim-Owned Websites

Remediation for GitHub ghost account recon

Immediate actions

  • Enable GitHub organization audit log streaming (github.audit.streaming / GitHub Enterprise audit log export) to a SIEM for retroactive and ongoing visibility
  • Search audit/access logs for the published suspicious user agents (e.g. gha-injection-scanner, GitHub-Repo-Crawler, gh-repo-lister, GitHub-Company-Scraper, GitHub-Scraper-Tool, repo-dumper, githarvester, GitHubAnalytics, GitHubDashboard, GitHub-Monitor, GitHubMetrics, GitHub-Insights, RepoAnalyzer, GitHub-Commit-Fetcher, GitHub-Event-Fetcher, bare 'request')
  • Investigate and revoke any Personal Access Tokens (classic and fine-grained) or OAuth tokens showing access from unrecognized IPs/ASNs, unusual request volumes, or non-baseline user agents
  • Identify and disable any organizational member accounts matching long-dormant-then-suddenly-active patterns (2-5 years inactive followed by a burst of API activity)
  • Review any evt.action:git.clone or evt.action:repo.download_zip events against private repositories for anomalous programmatic_access_type values

Workarounds

  • Restrict PAT/OAuth token scopes to the minimum required repositories and permissions
  • Enable SAML/SSO enforcement and IP allowlisting for organization API access where supported by the GitHub plan tier

Longer-term hardening

  • Baseline normal developer/CI user-agent and request-volume patterns per organization to detect deviations
  • Enforce short-lived, fine-grained PATs and mandatory OAuth app review/allowlisting instead of long-lived classic PATs
  • Require periodic re-authentication / token rotation and automatic revocation of tokens unused for extended periods
  • Deploy continuous secret-scanning (push protection) to reduce the supply of leaked PATs/OAuth tokens that feed this abuse
  • Build organization-specific detections for anomalous GraphQL bulk-query patterns against /graphql

Affected and fixed versions

  • GitHub — GitHub.com REST API and GraphQL API
    Vulnerable versions: N/A - abuse of legitimate API functionality and valid credentials, not a software vulnerability
    Fixed in: N/A

Timeline of GitHub ghost account recon

  • Datadog Security Labs begins tracking anomalous GitHub API enumeration activity, with confirmed activity dating to at least October 2025.
  • A distinct sub-campaign using compromised Personal Access Tokens and OAuth tokens begins, deploying custom scraping tooling (locked-ioc-8) hosted on infrastructure at locked-ioc-24.
  • Operators iterate their tooling mid-campaign, moving from locked-ioc-8 to locked-ioc-9, indicating active development and operational refinement.
  • Campaign tooling evolves further to locked-ioc-10, continuing to probe organization and private-repository paths; private-repo access attempts in this sub-campaign return unsuccessful (non-2xx) responses.
  • Datadog documents 50+ dormant 'ghost' GitHub accounts (created 2-5 years prior) activated in short 1-3 week operational bursts to enumerate organizations, repositories, followers, gists, and starred repos via REST and GraphQL.
  • An account using the 'locked-ioc-25' user agent is confirmed to have successfully cloned a private repository via mixed git.clone and api.request events, the only confirmed unauthorized private-repository access in the disclosed dataset.
  • Datadog Security Labs publishes the full technical report; Wiz Threats and The Hacker News publish incident summaries the same day, followed by additional outlet coverage (TechNadu, SecurityWeek, DevOps.com, CySecurity News).
  • Wiz Threats' incident tracking page for the campaign receives its last documentation update.

Sources cited for GitHub ghost account recon

Previous and next in supply chain

Further reading

Drafted by the Threadlinqs research pipeline from 9 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats