Coordinated GitHub API Enumeration and Access Token Abuse Campaign (Ghost Accounts + Compromised PAT/OAuth Tokens)
Coordinated GitHub API Enumeration and Access Token Abuse (TL-2026-1399) is a medium-severity supply-chain compromise, first published 2026-07-16. It has no confirmed attribution, affects GitHub GitHub.com REST API and GraphQL API, maps to 18 MITRE ATT&CK techniques (T1036, T1078, T1087), and is covered by 9 detection rules and 25 indicators of compromise.
Key facts for TL-2026-1399
- Threat ID
- TL-2026-1399
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-07-16
- Last reviewed
- 2026-07-16
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Detection rules
- 9
- Indicators of compromise
- 25
Datadog Security Labs identified multiple overlapping, coordinated campaigns abusing the legitimate GitHub REST and GraphQL APIs to systematically enumerate organizations, repositories, users, and developer activity at scale. Operators use 50+ dormant 'ghost' accounts (created 2-5 years prior, then activated for 1-3 week bursts) alongside compromised Personal Access Tokens (PATs) and OAuth tokens to blend reconnaissance traffic into normal developer usage, and in at least one confirmed instance succeeded in cloning a private repository.
How Coordinated GitHub API Enumeration and Access Token Abuse works
Between at least October 2025 and July 2026, Datadog Security Labs tracked several distinct but overlapping campaigns abusing GitHub's public REST API and GraphQL endpoint for mass reconnaissance. The operators registered or acquired GitHub accounts years in advance (2-5 years of dormancy observed across 50+ 'ghost' accounts) and left them inactive to avoid triggering new-account risk signals, later activating them in short 1-3 week operational bursts to query organization, repository, user, follower/following, gist, and starred-repo data. A second, distinct sub-campaign observed between late December 2025 and early January 2026 relied on compromised Personal Access Tokens (classic and fine-grained) and OAuth tokens harvested from legitimate developers, using a versioned progression of custom scraping tools (GitHub-Commit-Fetcher/1.3 -> 1.4 -> GitHub-Event-Fetcher/2.2) hosted on infrastructure at 3xktech[.]cloud, a hosting provider with a history of abuse reports. The heaviest concentration of traffic hit GitHub's /graphql endpoint, which is well suited to bulk queries across organizations, repositories, and users, alongside REST routes for organization repo listings and user profile/social-graph enumeration. While the bulk of the activity targeted public repositories and metadata, Datadog confirmed that in at least one case an account using the 'repo-dumper' user agent successfully accessed and cloned a private repository via a mix of git.clone and api.request events, indicating the token-holder's access scope included private resources. A parallel token-compromise sub-campaign attempted private-repository access but its probes returned unsuccessful (non-2xx) responses. No malware payload, exploit, or CVE is associated with this campaign; the technique is entirely an abuse of legitimate GitHub API functionality and valid credentials rather than a software vulnerability. The campaigns are unattributed and appear to represent multiple independent operators rather than a single actor, given the divergent tooling, infrastructure, and account patterns observed. The primary risk is intelligence-gathering on organizational structure, developer identities, and codebase contents, with a secondary supply-chain risk where private-repository access could expose proprietary source code, embedded secrets, or CI/CD configuration to downstream compromise.
MITRE ATT&CK techniques used in TL-2026-1399
Defense Evasion
T1036 Masquerading; T1078 Valid Accounts
Initial Access
Discovery
T1087 Account Discovery; T1526 Cloud Service Discovery; T1580 Cloud Infrastructure Discovery; T1619 Cloud Storage Object Discovery
Collection
T1119 Automated Collection; T1213 Data from Information Repositories
lateral-movement
T1550 Use Alternate Authentication Material
Credential Access
Exfiltration
T1567 Exfiltration Over Web Service
Resource Development
T1583 Acquire Infrastructure; T1585 Establish Accounts; T1586 Compromise Accounts; T1588 Obtain Capabilities
Reconnaissance
T1589 Gather Victim Identity Information; T1593 Search Open Websites/Domains; T1594 Search Victim-Owned Websites
Affected products and versions in Coordinated GitHub API Enumeration and Access Token Abuse
- GitHub — GitHub.com REST API and GraphQL API
Vulnerable versions: N/A - abuse of legitimate API functionality and valid credentials, not a software vulnerability
Fixed in: N/A
Remediation for Coordinated GitHub API Enumeration and Access Token Abuse
Immediate actions
- Enable GitHub organization audit log streaming (github.audit.streaming / GitHub Enterprise audit log export) to a SIEM for retroactive and ongoing visibility
- Search audit/access logs for the published suspicious user agents (e.g. gha-injection-scanner, GitHub-Repo-Crawler, gh-repo-lister, GitHub-Company-Scraper, GitHub-Scraper-Tool, repo-dumper, githarvester, GitHubAnalytics, GitHubDashboard, GitHub-Monitor, GitHubMetrics, GitHub-Insights, RepoAnalyzer, GitHub-Commit-Fetcher, GitHub-Event-Fetcher, bare 'request')
- Investigate and revoke any Personal Access Tokens (classic and fine-grained) or OAuth tokens showing access from unrecognized IPs/ASNs, unusual request volumes, or non-baseline user agents
- Identify and disable any organizational member accounts matching long-dormant-then-suddenly-active patterns (2-5 years inactive followed by a burst of API activity)
- Review any evt.action:git.clone or evt.action:repo.download_zip events against private repositories for anomalous programmatic_access_type values
Workarounds
- Restrict PAT/OAuth token scopes to the minimum required repositories and permissions
- Enable SAML/SSO enforcement and IP allowlisting for organization API access where supported by the GitHub plan tier
Longer-term hardening
- Baseline normal developer/CI user-agent and request-volume patterns per organization to detect deviations
- Enforce short-lived, fine-grained PATs and mandatory OAuth app review/allowlisting instead of long-lived classic PATs
- Require periodic re-authentication / token rotation and automatic revocation of tokens unused for extended periods
- Deploy continuous secret-scanning (push protection) to reduce the supply of leaked PATs/OAuth tokens that feed this abuse
- Build organization-specific detections for anomalous GraphQL bulk-query patterns against /graphql
Timeline of Coordinated GitHub API Enumeration and Access Token Abuse
- Datadog Security Labs begins tracking anomalous GitHub API enumeration activity, with confirmed activity dating to at least October 2025.
- A distinct sub-campaign using compromised Personal Access Tokens and OAuth tokens begins, deploying custom scraping tooling (GitHub-Commit-Fetcher/1.3) hosted on infrastructure at 3xktech[.]cloud.
- Operators iterate their tooling mid-campaign, moving from GitHub-Commit-Fetcher/1.3 to GitHub-Commit-Fetcher/1.4, indicating active development and operational refinement.
- Campaign tooling evolves further to GitHub-Event-Fetcher/2.2, continuing to probe organization and private-repository paths; private-repo access attempts in this sub-campaign return unsuccessful (non-2xx) responses.
- Datadog documents 50+ dormant 'ghost' GitHub accounts (created 2-5 years prior) activated in short 1-3 week operational bursts to enumerate organizations, repositories, followers, gists, and starred repos via REST and GraphQL.
- An account using the 'repo-dumper' user agent is confirmed to have successfully cloned a private repository via mixed git.clone and api.request events, the only confirmed unauthorized private-repository access in the disclosed dataset.
- Datadog Security Labs publishes the full technical report; Wiz Threats and The Hacker News publish incident summaries the same day, followed by additional outlet coverage (TechNadu, SecurityWeek, DevOps.com, CySecurity News).
- Wiz Threats' incident tracking page for the campaign receives its last documentation update.
Sources cited for Coordinated GitHub API Enumeration and Access Token Abuse
- Coordinated GitHub API Enumeration and Access Token Abuse
- Coordinated GitHub API enumeration and access token abuse
- Dormant GitHub Accounts Help Attackers Blend In While Mapping Corporate Orgs
- Datadog GitHub API Enumeration Campaigns Analysis Report
- Ghost Accounts Abuse GitHub API in Mass Recon Campaign
- Ghost Accounts Abuse GitHub API in Mass Recon Campaign (mirror)
- Hackers Turn 50+ Dormant GitHub Accounts Into a Network for Corporate Source Code Recon
- Datadog Uncovers Coordinated GitHub API Campaigns Targeting Organizations for Large-Scale Reconnaissance
- GitHub API Abuse, 'Ghost' Accounts Part of Malicious Efforts to Map Organizations
Threats related to Coordinated GitHub API Enumeration and Access Token Abuse
- ShutterGap: Ephemeral Public Exposure of AWS RDS/DocumentDB Snapshots, AMIs & SSM Documents Evades CSPM/CNAPP Scan Cycles
- Alleged Żabka Polska Breach: 541K Jira Issues, 230K IT Tickets, 89 GitLab Repos, and Cloudflare/MongoDB/Broker Credentials Offered for €5,000
- npm 12 Disables Install Scripts, Git Dependencies, and Remote Tarball URLs by Default to Curb Supply-Chain Worms Like Shai-Hulud
- ModernStealer: Cross-Platform Dark Web/Telegram Broker Network Claims Sale of Government and Defense Data
- CosmosEscape: Gremlin API Sandbox Escape Exposed Platform-Wide Key for Every Azure Cosmos DB Database
- Pickle in the Middle: Vertex AI Model Upload Hijacking via GCS Bucket Squatting Enables Cross-Tenant RCE (google-cloud-aiplatform v1.139.0/v1.140.0)
Detection coverage for TL-2026-1399
As of 2026-07-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1399 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.