Coordinated GitHub API Enumeration and Access Token Abuse Campaign
Coordinated GitHub API Enumeration and Access Token Abuse (TL-2026-2339) is a high-severity data breach, first published 2026-09-05. It has no confirmed attribution, affects GitHub GitHub.com (GraphQL API and REST API), maps to 12 MITRE ATT&CK techniques (T1036.005, T1078.004, T1087.004), and is covered by 9 detection rules and 23 indicators of compromise.
Key facts for TL-2026-2339
- Threat ID
- TL-2026-2339
- Severity
- HIGH
- Status
- ACTIVE
- Category
- DATA_BREACH
- First published
- 2026-09-05
- Last reviewed
- 2026-09-05
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Detection rules
- 9
- Indicators of compromise
- 23
Malware and tooling in Coordinated GitHub API Enumeration and Access Token Abuse
Malware and tooling: GitHub-Commit-Fetcher/1.3, GitHub-Commit-Fetcher/1.4, GitHub-Company-Scraper, GitHub-Event-Fetcher/2.2, GitHub-Insights/3.2, GitHub-Inspector/2.9, GitHub-Monitor/2.5, GitHub-Repo-Crawler/1.0, GitHub-Scraper-Tool/1.0, GitHub-Tracker/3.1, GitHubAnalytics/1.5, GitHubDashboard/1.8
Datadog Security Labs documents a coordinated, multi-sourced campaign against GitHub organizations combining over 50 dormant 'ghost' accounts reactivated to send API traffic, stolen OAuth access tokens and personal access tokens, and custom scanner tooling to enumerate org membership, repositories, and follower graphs via the GraphQL and REST APIs. In at least one confirmed case, a client using the user agent 'repo-dumper' escalated past reconnaissance to access and exfiltrate data from a private repository.
How Coordinated GitHub API Enumeration and Access Token Abuse works
Since October 2025, Datadog Security Labs has tracked several overlapping campaigns systematically enumerating corporate GitHub organizations, repositories, and user accounts through the GitHub API. The activity blends three distinct techniques rather than representing a single actor's toolkit: (1) a network of more than 50 'ghost' GitHub accounts, registered two to five years prior and left completely dormant, that were reactivated in short bursts of one to three weeks to send coordinated API traffic across multiple target organizations; (2) abuse of compromised OAuth access tokens and Personal Access Tokens (PATs, both classic and fine-grained) belonging to legitimate users, used to query private repository commit paths; and (3) a rotating stable of custom-built scanner tools disguised behind legitimate-sounding user-agent strings (analytics dashboards, repo visualizers, commit fetchers, metrics/reporter/tracker tools) that were iterated and version-bumped over tight windows, indicating active tool development during the campaign.
Most observed requests targeted GitHub's unauthenticated, publicly reachable API surface -- organization listings (`/organizations/:organization_id`, `/organizations/:organization_id/repos`), user follower/following graphs (`/user/:user_id/followers`, `/following`), gists, starred repos, org memberships (`/user/:user_id/gists`, `/orgs`, `/repos`, `/starred`), and bulk GraphQL queries against public objects -- returning HTTP 200 responses that blend into ordinary API traffic and evade simple failure-based detections. Datadog senior security engineer Julie Agnes Sparks characterized the operators as relying on "automated scraping tooling with custom or legitimate-sounding user agents, leveraging GitHub 'ghost' accounts that are often years old," noting that individually most requests are unremarkable and the signal only emerges in the aggregate: a group of accounts moving in sync across an organization's GitHub estate.
Ghost-account naming followed several distinguishable clusters -- an `amazon-data-*` prefix family, `kobalt*` variants, a `*-orb` family (kuku-orb, lolo-orb, lulu-orb, ruru-orb, zouzou-orb, meme-orb), a BirdWithDreams/BirdWithPlan pair, and a numeric-suffix pattern (user432023, user412023) -- consistent with automated, templated account provisioning done years in advance of use (sleeper infrastructure), distinct from the separately-abused OAuth/PAT tokens stolen from real, currently-active user accounts. Between late December 2025 and early January 2026, Datadog observed a discrete campaign using stolen tokens paired with a rapidly versioned tool (GitHub-Commit-Fetcher/1.3 to /1.4, then GitHub-Event-Fetcher/2.2), and separately documented one operation in which exposed tokens across dozens of distinct accounts were exploited within minutes of one another, indicating scripted, synchronized execution rather than manual operator activity.
The most severe confirmed incident involved the user agent 'repo-dumper,' which took actions inside a private repository belonging to a single organization; the GitHub audit log captured the exfiltration through a mix of git.clone and api.request events against private paths, with repo.download_zip flagged by Datadog as an equivalent exfiltration primitive to hunt for. Both accounts involved in that incident had previously been observed in earlier, failed reconnaissance attempts against the same organization, indicating the operators persisted and eventually escalated from enumeration to actual data access.
Infrastructure supporting the scanning traffic was traced to dedicated hosting at cherryservers[.]com and 3xktech[.]cloud; the latter is operated by 3xK Tech GmbH, a hosting provider independently documented by third-party IP-reputation services as running tens of thousands of IPs heavily associated with anonymizing VPN traffic and a non-trivial fraud/abuse score, consistent with its reuse across unrelated abuse campaigns and functioning as a de facto proxy layer that obscures the operators' true origin. Datadog's recommended defensive posture centers on GitHub audit log streaming into a SIEM, baselining legitimate user-agent and access patterns, and hunting for synchronized multi-account activity that transitions from public enumeration into private-repository git.clone, api.request, or repo.download_zip events from OAuth/PAT-authenticated sessions, filtered on `programmatic_access_type:(*OAuth* OR "Personal access token (classic)" OR "Fine-grained personal access token")`.
MITRE ATT&CK techniques used in TL-2026-2339
Defense Evasion
T1036.005 Match Legitimate Resource Name or Location
Initial Access
Discovery
T1087.004 Cloud Account; T1526 Cloud Service Discovery
Command and Control
Collection
lateral-movement
T1550.001 Application Access Token
Exfiltration
T1567 Exfiltration Over Web Service
Resource Development
T1583.003 Virtual Private Server; T1585.003 Cloud Accounts; T1588.002 Tool
Reconnaissance
Affected products and versions in Coordinated GitHub API Enumeration and Access Token Abuse
- GitHub — GitHub.com (GraphQL API and REST API)
Vulnerable versions: N/A - abuse of legitimate API/authentication functionality, not a software vulnerability
Remediation for Coordinated GitHub API Enumeration and Access Token Abuse
Immediate actions
- Enable GitHub audit log streaming (github.audit.streaming / github-telemetry) into a SIEM for real-time visibility into org-level API activity
- Baseline and alert on unrecognized or anomalous User-Agent strings issuing GitHub API/GraphQL requests against your organizations
- Immediately revoke and rotate any OAuth authorizations or Personal Access Tokens (classic and fine-grained) that are unused, over-privileged, or unrecognized
- Audit organization membership for accounts that were dormant for years and recently resumed activity; disable or re-verify those accounts
Workarounds
- Restrict OAuth app and PAT scopes to the minimum repositories required
- Alert on git.clone / api.request / repo.download_zip events against private repositories authenticated via OAuth or PAT tokens
Longer-term hardening
- Migrate from classic PATs to fine-grained PATs with scoped repository permissions and short expirations across the organization
- Enforce SSO/SAML for all organization members and run periodic access reviews of third-party OAuth app authorizations
- Build threat-hunting detections for coordinated, near-simultaneous API access to a single organization from multiple distinct accounts
- Track source ASN and hosting-provider reputation for API traffic hitting organization resources
Timeline of Coordinated GitHub API Enumeration and Access Token Abuse
- Datadog Security Labs begins monitoring coordinated GitHub API enumeration activity; more than 50 ghost accounts are eventually confirmed participating since this point.
- Dormant GitHub accounts created 2-5 years prior begin reactivating in short bursts of one to three weeks to send coordinated API traffic across multiple target organizations.
- Datadog tracks a discrete campaign using stolen OAuth/PAT tokens to query private repository commit paths, coinciding with the user agent GitHub-Commit-Fetcher/1.3.
- Datadog separately documents an operation in which exposed OAuth/PAT tokens across dozens of distinct accounts were exploited within minutes of one another, indicating scripted, synchronized execution rather than manual, one-off token abuse.
- Scanner tooling version-bumps to GitHub-Commit-Fetcher/1.4 within the same tight campaign window, indicating active tool iteration.
- The user agent 'repo-dumper' escalates from reconnaissance to actual data access, using a mix of git.clone and api.request events to access and exfiltrate data from a private repository; both accounts involved had prior failed reconnaissance attempts against the same organization.
- Scanner tooling progresses to GitHub-Event-Fetcher/2.2, the last observed version bump in the monitoring window.
- Datadog Security Labs publishes 'Coordinated GitHub API enumeration and access token abuse,' disclosing the campaign, IOCs, and detection queries; senior security engineer Julie Agnes Sparks is quoted on the operators' use of ghost accounts and disguised scanning tools.
- The Hacker News and subsequent outlets (SecurityWeek, Technadu, CyberSecurityNews, DevOps.com) republish and expand on the Datadog findings.
Sources cited for Coordinated GitHub API Enumeration and Access Token Abuse
- Coordinated GitHub API enumeration and access token abuse
- Dormant GitHub Accounts Help Attackers Blend In While Mapping Corporate Orgs
- Datadog GitHub API Enumeration Campaigns Analysis Report
- Ghost Accounts Abuse GitHub API in Mass Recon Campaign
- GitHub API Abuse, 'Ghost' Accounts Part of Malicious Efforts to Map Organizations
- Hackers Turn 50+ Dormant GitHub Accounts Into a Network for Corporate Source Code Recon
More in data breach
- Condé Nast Data Breach: 32.8 Million User Records Offered for Sale Following WIRED Leak
- DaVita Settles $15M Class Action Over Interlock Ransomware Breach Affecting 2.7M Patients
- PEAR ransomware group claims data leak from South Plains Rural Health Services (SPRHS)
- ShinyHunters Extortion Group Claims 284M-Record McKesson Corporation Data Breach via Vishing and Salesforce/Snowflake Compromise
- Qilin Ransomware Gang Claims Breach of US ATF; Agency Confirms 'Major Incident' on Isolated Investigations System
Detection coverage for TL-2026-2339
As of 2026-09-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2339 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.