Threat reportThreat IntelligenceTL-2026-4551
Coordinated GitHub API Enumeration and Access Token Abuse Targeting GitHub Organizations
Coordinated GitHub API Enumeration and Access Token Abuse (TL-2026-4551), also tracked as GitHub ghost account reconnaissance, is a high-severity tracked intrusion set, first published 2026-10-27. It has no confirmed attribution, affects GitHub GitHub organizations (API, OAuth tokens, personal access, maps to 11 MITRE ATT&CK techniques (T1078.004, T1087.004, T1119), and is covered by 9 detection rules and 40 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 11MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 40Indicators of compromise
Key facts for TL-2026-4551
- Threat ID
- TL-2026-4551
- Also known as
- GitHub ghost account reconnaissance
- Severity
- HIGH
- Status
- ACTIVE
- Category
- THREAT_INTEL
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, software-development, enterprise
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 40
Malware and tooling in Coordinated GitHub API Enumeration and Access Token Abuse
Malware and tooling: GitHarvester
How Coordinated GitHub API Enumeration and Access Token Abuse works
Datadog Security Research tracked overlapping campaigns combining custom automated scanners, leaked OAuth/PAT abuse and networks of dormant 'ghost' accounts systematically enumerating corporate GitHub organizations. At least one case escalated to successful cloning of private repositories.
Datadog Security Research began monitoring in October 2025 and identified several overlapping campaigns (not attributed to a single actor) that systematically enumerate GitHub organizations, repositories and user accounts through the GitHub API. The activity blends custom scraping tools with legitimate-sounding or fake-versioned user agents, opportunistic use of stolen OAuth tokens and personal access tokens (PATs), and a coordinated network of more than 50 ghost accounts. Ghost accounts were created two to five years earlier, stayed dormant, and then became active in bursts of one to three weeks per targeted organization, which lends them apparent legitimacy.
Reconnaissance relies on public API endpoints and bulk GraphQL queries: organization repository and member listings, user followers/following, gists, starred repositories and organization memberships (/graphql, /organizations/:organization_id[/repos], /user/:user_id/{followers,following,gists,orgs,repos,starred}). Because most requests return HTTP 200 for public data, the traffic blends into normal API usage.
A second campaign, observed in late December 2025 and early January 2026, used stolen OAuth tokens and PATs from legitimate users with versioned user agents (e.g. GitHub-Commit-Fetcher/1.3 and 1.4, GitHub-Event-Fetcher/2.2). It repeatedly targeted private repository commit paths across dozens of accounts within minutes. In one confirmed case, a client using the repo-dumper user agent accessed private repositories through a mix of git.clone and api.request events to private paths, indicating successful exfiltration of source code. The tool GitHarvester is also named in the source. Infrastructure is associated with 3xK Tech (with a history of abuse) and cherryservers.com.
Relevant GitHub audit log events are api.request, git.clone and repo.download_zip. Datadog recommends enabling audit log streaming, baselining legitimate user agents, hunting on programmatic access type (OAuth, classic PAT, fine-grained PAT), user agent anomalies (fake version strings such as /1.0), source ASN, and successful access to private resources. No CVE is involved and no single actor is attributed. Severity is analyst-assigned.
MITRE ATT&CK techniques used in TL-2026-4551
Initial Access
Discovery
Collection
T1119 Automated Collection; T1213.003 Code Repositories
Credential Access
T1528 Steal Application Access Token
lateral-movement
T1550.001 Application Access Token
Resource Development
T1583.003 Virtual Private Server; T1585.001 Social Media Accounts
Reconnaissance
T1589 Gather Victim Identity Information; T1593.003 Code Repositories; T1595 Active Scanning
Affected products and versions in Coordinated GitHub API Enumeration and Access Token Abuse
- GitHub — GitHub organizations (API, OAuth tokens, personal access tokens)
Vulnerable versions: Organizations exposing public API data or with leaked OAuth tokens/PATs
Remediation for Coordinated GitHub API Enumeration and Access Token Abuse
Immediate actions
- Hunt GitHub audit logs for api.request, git.clone and repo.download_zip events against private repositories made with OAuth, classic PAT or fine-grained PAT access
- Revoke and rotate any OAuth tokens and PATs associated with anomalous user agents or unexpected private repository access
- Review the org for unexpected member or collaborator accounts matching the ghost account naming patterns (amazon-data-*, kobalt*, *-orb, BirdWithDreams, BirdWithPlan, user432023, user412023)
Workarounds
- Monitor and restrict token use to expected IP ranges where feasible
- Review whether organization member lists and repositories need to be publicly visible
Longer-term hardening
- Enable GitHub audit log streaming to the SIEM
- Baseline legitimate user agents and source ASNs for programmatic access in your environment and alert on deviations
- Develop organization-specific detections for fake-versioned user agents (e.g. /1.0, /1.1)
- Prefer fine-grained, short-lived tokens and restrict OAuth app and PAT access by policy
Weaknesses (CWE) in Coordinated GitHub API Enumeration and Access Token Abuse
Timeline of Coordinated GitHub API Enumeration and Access Token Abuse
- Datadog Security Research began monitoring GitHub API enumeration activity (October 2025; exact day not stated); 50+ ghost accounts tracked since.
- Late December 2025: token compromise campaign observed using stolen OAuth tokens/PATs and versioned user agents such as GitHub-Commit-Fetcher/1.3 (day approximate).
- Early January 2026: campaign continued with GitHub-Commit-Fetcher/1.4 and GitHub-Event-Fetcher/2.2, repeatedly probing private repository commit paths across dozens of accounts within minutes (day approximate).
- Wiz Threats published an incident entry for the campaign (actor unknown, initial access vector 'exposed secret', primary impact data exfiltration).
- Datadog released audit-log hunting queries for api.request, git.clone and repo.download_zip against private repositories using OAuth/PAT access.
- Datadog Security Labs published 'Coordinated GitHub API enumeration and access token abuse', documenting ghost accounts, user agents and one case of successful private repository cloning via repo-dumper.
- Wiz Threats last edited and finalized its incident entry for the Datadog-reported GitHub API enumeration and token abuse campaign.
Sources cited for Coordinated GitHub API Enumeration and Access Token Abuse
- Coordinated GitHub API enumeration and access token abuse (Datadog Security Labs)
- Coordinated GitHub API enumeration (Datadog Security Labs, markdown)
- Coordinated GitHub API Enumeration and Access Token Abuse (Wiz Threats)
- Ghost Accounts Abuse GitHub API in Mass Recon Campaign (SecurityWeek)
- Hackers Turn Dormant GitHub Accounts for Recon (Cyber Security News)
- Datadog Warns of Coordinated GitHub API Enumeration Campaigns Targeting Organizations (TechNadu)
- Datadog says months-long GitHub recon out of dormant ghost accounts is prep for supply chain (DEV Community)
- Coordinated GitHub API Enumeration and Token Abuse (detections.ai Intel Exchange)
- GitHarvester source repository
- GitHarvester (Pentest Reports tool listing)
Detection coverage for TL-2026-4551
As of 2026-10-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4551 across Splunk SPL, Microsoft KQL and Sigma, covering 40 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.