# Coordinated GitHub API Enumeration and Access Token Abuse Campaign (Ghost Accounts + Compromised PAT/OAuth Tokens)

> Datadog Security Labs identified multiple overlapping, coordinated campaigns abusing the legitimate GitHub REST and GraphQL APIs to systematically enumerate organizations, repositories, users, and developer activity at scale. Operators use 50+ dormant 'ghost' accounts (created 2-5 years prior, then activated for 1-3 week bursts) alongside compromised Personal Access Tokens (PATs) and OAuth tokens to blend reconnaissance traffic into normal developer usage, and in at least one confirmed instance succeeded in cloning a private repository.

- **Published:** 2026-07-16T00:00:00Z
- **Last reviewed:** 2026-07-16T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1399
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-github-ghost-account-recon-tl-2026-1399.webp?v=fb715d78 (Threadlinqs threat intel: Ghost Accounts GitHub Token Abuse Recon: Detection & IOCs (TL-2026-1399) — Medium severity, 25 IOCs, 9 detection rules.)
- **ID:** TL-2026-1399
- **Severity:** MEDIUM
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 25 (2 shown free below)

## Description

Between at least October 2025 and July 2026, Datadog Security Labs tracked several distinct but overlapping campaigns abusing GitHub's public REST API and GraphQL endpoint for mass reconnaissance. The operators registered or acquired GitHub accounts years in advance (2-5 years of dormancy observed across 50+ 'ghost' accounts) and left them inactive to avoid triggering new-account risk signals, later activating them in short 1-3 week operational bursts to query organization, repository, user, follower/following, gist, and starred-repo data. A second, distinct sub-campaign observed between late December 2025 and early January 2026 relied on compromised Personal Access Tokens (classic and fine-grained) and OAuth tokens harvested from legitimate developers, using a versioned progression of custom scraping tools (GitHub-Commit-Fetcher/1.3 -> 1.4 -> GitHub-Event-Fetcher/2.2) hosted on infrastructure at 3xktech[.]cloud, a hosting provider with a history of abuse reports. The heaviest concentration of traffic hit GitHub's /graphql endpoint, which is well suited to bulk queries across organizations, repositories, and users, alongside REST routes for organization repo listings and user profile/social-graph enumeration. While the bulk of the activity targeted public repositories and metadata, Datadog confirmed that in at least one case an account using the 'repo-dumper' user agent successfully accessed and cloned a private repository via a mix of git.clone and api.request events, indicating the token-holder's access scope included private resources. A parallel token-compromise sub-campaign attempted private-repository access but its probes returned unsuccessful (non-2xx) responses. No malware payload, exploit, or CVE is associated with this campaign; the technique is entirely an abuse of legitimate GitHub API functionality and valid credentials rather than a software vulnerability. The campaigns are unattributed and appear to represent multiple independent operators rather than a single actor, given the divergent tooling, infrastructure, and account patterns observed. The primary risk is intelligence-gathering on organizational structure, developer identities, and codebase contents, with a secondary supply-chain risk where private-repository access could expose proprietary source code, embedded secrets, or CI/CD configuration to downstream compromise.

## MITRE ATT&CK

- T1593 Search Open Websites/Domains
- T1594 Search Victim-Owned Websites
- T1589 Gather Victim Identity Information
- T1583 Acquire Infrastructure
- T1585 Establish Accounts
- T1588 Obtain Capabilities
- T1586 Compromise Accounts
- T1078 Valid Accounts
- T1036 Masquerading
- T1550 Use Alternate Authentication Material
- T1078 Valid Accounts
- T1526 Cloud Service Discovery
- T1087 Account Discovery
- T1580 Cloud Infrastructure Discovery
- T1619 Cloud Storage Object Discovery
- T1213 Data from Information Repositories
- T1119 Automated Collection
- T1567 Exfiltration Over Web Service
- T1552 Unsecured Credentials

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**GitHub Scraper User-Agent Enumeration Burst (SPL)** (`TL-2026-1399-SPL-001`)

Detects a single actor/token issuing a high-volume burst of GitHub REST/GraphQL requests using known disguised scraper user agents (GitHub-Repo-Crawler, gh-repo-lister, GitHub-Company-Scraper, GitHub-Scraper-Tool, repo-dumper, githarvester, GitHubAnalytics, GitHubDashboard, GitHub-Monitor, GitHubMetrics, GitHub-Insights, RepoAnalyzer, GitHub-Commit-Fetcher, GitHub-Event-Fetcher, gha-injection-scanner) against organization/repository/user/follower/gist/starred endpoints — the reconnaissance signature of the ghost-account and token-abuse campaigns.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1593, T1594, T1119
- **Data sources:** github_audit_log, github_rest_api_logs, github_graphql_api_logs
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=github_audit sourcetype="github:audit:log"
| eval scraper_ua=case(
    match(user_agent, "(?i)GitHub-Repo-Crawler"), 1,
    match(user_agent, "(?i)gh-repo-lister"), 1,
    match(user_agent, "(?i)GitHub-Company-Scraper"), 1,
    match(user_agent, "(?i)GitHub-Scraper-Tool"), 1,
    match(user_agent, "(?i)repo-dumper"), 1,
    match(user_agent, "(?i)githarvester"), 1,
    match(user_agent, "(?i)GitHubAnalytics"), 1,
    match(user_agent, "(?i)GitHubDashboard"), 1,
    match(user_agent, "(?i)GitHub-Monitor"), 1,
    match(user_agent, "(?i)GitHubMetrics"), 1,
    match(user_agent, "(?i)GitHub-Insights"), 1,
    match(user_agent, "(?i)RepoAnalyzer"), 1,
    match(user_agent, "(?i)GitHub-Commit-Fetcher"), 1,
    match(user_agent, "(?i)GitHub-Event-Fetcher"), 1,
    match(user_agent, "(?i)gha-injection-scanner"), 1,
    true(), 0)
| where scraper_ua=1
| bucket _time span=10m
| stats count as request_count, dc(action) as distinct_actions, values(action) as actions, values(repo) as repos_touched by _time, actor, user_agent, src_ip
| where request_count >= 25
| sort - request_count
```

### Microsoft KQL

```kql
GitHubAuditLogPolling_CL
| where TimeGenerated > ago(24h)
| where UserAgent_s has_any ("GitHub-Repo-Crawler", "gh-repo-lister", "GitHub-Company-Scraper", "GitHub-Scraper-Tool", "repo-dumper", "githarvester", "GitHubAnalytics", "GitHubDashboard", "GitHub-Monitor", "GitHubMetrics", "GitHub-Insights", "RepoAnalyzer", "GitHub-Commit-Fetcher", "GitHub-Event-Fetcher", "gha-injection-scanner")
| summarize RequestCount = count(), DistinctActions = dcount(Action_s), Actions = make_set(Action_s), Repos = make_set(Repo_s) by bin(TimeGenerated, 10m), Actor_s, UserAgent_s, ActorIp_s
| where RequestCount >= 25
| project TimeGenerated, Actor_s, UserAgent_s, ActorIp_s, RequestCount, DistinctActions, Actions, Repos
| sort by RequestCount desc
```

### Sigma

```yaml
title: GitHub API Scraper User-Agent Enumeration Burst
id: 6a7cf8e0-1b3f-4a2e-9c1e-7f0d9e5a1c11
status: experimental
description: Detects a burst of GitHub REST/GraphQL API requests from a known or disguised scraper user agent used in the Datadog-tracked coordinated GitHub API enumeration and token-abuse campaign.
references:
    - https://securitylabs.datadoghq.com/articles/coordinated-github-api-enumeration/
    - https://thehackernews.com/2026/07/dormant-github-accounts-help-attackers.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-16
tags:
    - attack.reconnaissance
    - attack.t1593
    - attack.t1594
    - attack.t1119
    - attack.tool.repo_dumper
logsource:
    product: github
    category: audit_log
detection:
    selection:
        user_agent|contains:
            - 'GitHub-Repo-Crawler'
            - 'gh-repo-lister'
            - 'GitHub-Company-Scraper'
            - 'GitHub-Scraper-Tool'
            - 'repo-dumper'
            - 'githarvester'
            - 'GitHubAnalytics'
            - 'GitHubDashboard'
            - 'GitHub-Monitor'
            - 'GitHubMetrics'
            - 'GitHub-Insights'
            - 'RepoAnalyzer'
            - 'GitHub-Commit-Fetcher'
            - 'GitHub-Event-Fetcher'
            - 'gha-injection-scanner'
    timeframe: 10m
    condition: selection | count() by actor > 25
falsepositives:
    - Legitimate internal analytics/dashboard tooling that happens to reuse one of these user-agent strings (rename internal tools to avoid collision)
level: high
```

**Known false positives:**

- Legitimate internal analytics, dashboard, or CI tooling that reuses one of the flagged user-agent strings without renaming it

**Tuning notes:** Baseline per-organization legitimate automation user agents (CI bots, internal dashboards) and allowlist them explicitly; lower the 25-request/10m threshold for smaller organizations with low baseline API volume.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- GraphQL Bulk-Enumeration Query Volume Spike (KQL) (locked: unlock with TL Creds)
- Compromised Token Access from Non-Baseline IP/ASN or Masqueraded User Agent (KQL) (locked: unlock with TL Creds)
- Versioned Custom Scraper Tool Iteration Against Org/Repo Endpoints (KQL) (locked: unlock with TL Creds)
- GitHub Ghost Account Cluster Naming Pattern Match (Sigma) (locked: unlock with TL Creds)
- Follower/Following/Gist/Starred-Repo Social-Graph Enumeration Sweep (Sigma) (locked: unlock with TL Creds)
- Unsuccessful Private-Repository Access Attempts by Compromised Token (Sigma) (locked: unlock with TL Creds)
- Dormant GitHub Account Sudden Activity Burst (SPL) (locked: unlock with TL Creds)
- Private Repository Clone/ZIP-Download via Anomalous Token Access (SPL) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 25)

Defanged, TLP:CLEAR.

- Domain: `3xktech[.]cloud`
- Domain: `cherryservers[.]com`

Full set of 25 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Coordinated GitHub API Enumeration and Access Token Abuse](https://threats.wiz.io/all-incidents/coordinated-github-api-enumeration-and-access-token-abuse)
- [Coordinated GitHub API enumeration and access token abuse](https://securitylabs.datadoghq.com/articles/coordinated-github-api-enumeration/)
- [Dormant GitHub Accounts Help Attackers Blend In While Mapping Corporate Orgs](https://thehackernews.com/2026/07/dormant-github-accounts-help-attackers.html)
- [Datadog GitHub API Enumeration Campaigns Analysis Report](https://www.technadu.com/datadog-github-api-enumeration-campaigns-analysis-report/630739/)
- [Ghost Accounts Abuse GitHub API in Mass Recon Campaign](https://www.securityweek.com/ghost-accounts-abuse-github-api-in-mass-recon-campaign/amp/)
- [Ghost Accounts Abuse GitHub API in Mass Recon Campaign (mirror)](https://www.hendryadrian.com/ghost-accounts-abuse-github-api-in-mass-recon-campaign/)
- [Hackers Turn 50+ Dormant GitHub Accounts Into a Network for Corporate Source Code Recon](https://cybersecuritynews.com/hackers-turn-dormant-github-accounts-for-recon/)
- [Datadog Uncovers Coordinated GitHub API Campaigns Targeting Organizations for Large-Scale Reconnaissance](https://www.cysecurity.news/2026/07/datadog-uncovers-coordinated-github-api.html)
- [GitHub API Abuse, 'Ghost' Accounts Part of Malicious Efforts to Map Organizations](https://devops.com/github-api-abuse-ghost-accounts-part-of-malicious-efforts-to-map-organizations/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1399