# Coordinated GitHub API Enumeration and Access Token Abuse Campaign

> Datadog Security Labs documents a coordinated, multi-sourced campaign against GitHub organizations combining over 50 dormant 'ghost' accounts reactivated to send API traffic, stolen OAuth access tokens and personal access tokens, and custom scanner tooling to enumerate org membership, repositories, and follower graphs via the GraphQL and REST APIs. In at least one confirmed case, a client using the user agent 'repo-dumper' escalated past reconnaissance to access and exfiltrate data from a private repository.

- **Published:** 2026-09-05T00:00:00Z
- **Last reviewed:** 2026-09-05T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2339
- **ID:** TL-2026-2339
- **Severity:** HIGH
- **Category:** DATA_BREACH
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 23 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Since October 2025, Datadog Security Labs has tracked several overlapping campaigns systematically enumerating corporate GitHub organizations, repositories, and user accounts through the GitHub API. The activity blends three distinct techniques rather than representing a single actor's toolkit: (1) a network of more than 50 'ghost' GitHub accounts, registered two to five years prior and left completely dormant, that were reactivated in short bursts of one to three weeks to send coordinated API traffic across multiple target organizations; (2) abuse of compromised OAuth access tokens and Personal Access Tokens (PATs, both classic and fine-grained) belonging to legitimate users, used to query private repository commit paths; and (3) a rotating stable of custom-built scanner tools disguised behind legitimate-sounding user-agent strings (analytics dashboards, repo visualizers, commit fetchers, metrics/reporter/tracker tools) that were iterated and version-bumped over tight windows, indicating active tool development during the campaign.

Most observed requests targeted GitHub's unauthenticated, publicly reachable API surface -- organization listings (`/organizations/:organization_id`, `/organizations/:organization_id/repos`), user follower/following graphs (`/user/:user_id/followers`, `/following`), gists, starred repos, org memberships (`/user/:user_id/gists`, `/orgs`, `/repos`, `/starred`), and bulk GraphQL queries against public objects -- returning HTTP 200 responses that blend into ordinary API traffic and evade simple failure-based detections. Datadog senior security engineer Julie Agnes Sparks characterized the operators as relying on "automated scraping tooling with custom or legitimate-sounding user agents, leveraging GitHub 'ghost' accounts that are often years old," noting that individually most requests are unremarkable and the signal only emerges in the aggregate: a group of accounts moving in sync across an organization's GitHub estate.

Ghost-account naming followed several distinguishable clusters -- an `amazon-data-*` prefix family, `kobalt*` variants, a `*-orb` family (kuku-orb, lolo-orb, lulu-orb, ruru-orb, zouzou-orb, meme-orb), a BirdWithDreams/BirdWithPlan pair, and a numeric-suffix pattern (user432023, user412023) -- consistent with automated, templated account provisioning done years in advance of use (sleeper infrastructure), distinct from the separately-abused OAuth/PAT tokens stolen from real, currently-active user accounts. Between late December 2025 and early January 2026, Datadog observed a discrete campaign using stolen tokens paired with a rapidly versioned tool (GitHub-Commit-Fetcher/1.3 to /1.4, then GitHub-Event-Fetcher/2.2), and separately documented one operation in which exposed tokens across dozens of distinct accounts were exploited within minutes of one another, indicating scripted, synchronized execution rather than manual operator activity.

The most severe confirmed incident involved the user agent 'repo-dumper,' which took actions inside a private repository belonging to a single organization; the GitHub audit log captured the exfiltration through a mix of git.clone and api.request events against private paths, with repo.download_zip flagged by Datadog as an equivalent exfiltration primitive to hunt for. Both accounts involved in that incident had previously been observed in earlier, failed reconnaissance attempts against the same organization, indicating the operators persisted and eventually escalated from enumeration to actual data access.

Infrastructure supporting the scanning traffic was traced to dedicated hosting at cherryservers[.]com and 3xktech[.]cloud; the latter is operated by 3xK Tech GmbH, a hosting provider independently documented by third-party IP-reputation services as running tens of thousands of IPs heavily associated with anonymizing VPN traffic and a non-trivial fraud/abuse score, consistent with its reuse across unrelated abuse campaigns and functioning as a de facto proxy layer that obscures the operators' true origin. Datadog's recommended defensive posture centers on GitHub audit log streaming into a SIEM, baselining legitimate user-agent and access patterns, and hunting for synchronized multi-account activity that transitions from public enumeration into private-repository git.clone, api.request, or repo.download_zip events from OAuth/PAT-authenticated sessions, filtered on `programmatic_access_type:(*OAuth* OR "Personal access token (classic)" OR "Fine-grained personal access token")`.

## MITRE ATT&CK

- T1593.003 Code Repositories
- T1583.003 Virtual Private Server
- T1588.002 Tool
- T1585.003 Cloud Accounts
- T1078.004 Cloud Accounts
- T1550.001 Application Access Token
- T1036.005 Match Legitimate Resource Name or Location
- T1087.004 Cloud Account
- T1526 Cloud Service Discovery
- T1213.003 Code Repositories
- T1090.002 External Proxy
- T1567 Exfiltration Over Web Service

## Sources

- [Coordinated GitHub API enumeration and access token abuse](https://securitylabs.datadoghq.com/articles/coordinated-github-api-enumeration/)
- [Dormant GitHub Accounts Help Attackers Blend In While Mapping Corporate Orgs](https://thehackernews.com/2026/07/dormant-github-accounts-help-attackers.html)
- [Datadog GitHub API Enumeration Campaigns Analysis Report](https://www.technadu.com/datadog-github-api-enumeration-campaigns-analysis-report/630739/)
- [Ghost Accounts Abuse GitHub API in Mass Recon Campaign](https://www.securityweek.com/ghost-accounts-abuse-github-api-in-mass-recon-campaign/)
- [GitHub API Abuse, 'Ghost' Accounts Part of Malicious Efforts to Map Organizations](https://devops.com/github-api-abuse-ghost-accounts-part-of-malicious-efforts-to-map-organizations/)
- [Hackers Turn 50+ Dormant GitHub Accounts Into a Network for Corporate Source Code Recon](https://cybersecuritynews.com/hackers-turn-dormant-github-accounts-for-recon/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2339