# Coordinated GitHub API Enumeration and Access Token Abuse Targeting GitHub Organizations

> Datadog Security Research tracked overlapping campaigns combining custom automated scanners, leaked OAuth/PAT abuse and networks of dormant 'ghost' accounts systematically enumerating corporate GitHub organizations. At least one case escalated to successful cloning of private repositories.

- **Published:** 2026-10-27T16:25:44Z
- **Last reviewed:** 2026-10-27T16:25:44Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4551
- **ID:** TL-2026-4551
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 40 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Datadog Security Research began monitoring in October 2025 and identified several overlapping campaigns (not attributed to a single actor) that systematically enumerate GitHub organizations, repositories and user accounts through the GitHub API. The activity blends custom scraping tools with legitimate-sounding or fake-versioned user agents, opportunistic use of stolen OAuth tokens and personal access tokens (PATs), and a coordinated network of more than 50 ghost accounts. Ghost accounts were created two to five years earlier, stayed dormant, and then became active in bursts of one to three weeks per targeted organization, which lends them apparent legitimacy.

Reconnaissance relies on public API endpoints and bulk GraphQL queries: organization repository and member listings, user followers/following, gists, starred repositories and organization memberships (/graphql, /organizations/:organization_id[/repos], /user/:user_id/{followers,following,gists,orgs,repos,starred}). Because most requests return HTTP 200 for public data, the traffic blends into normal API usage.

A second campaign, observed in late December 2025 and early January 2026, used stolen OAuth tokens and PATs from legitimate users with versioned user agents (e.g. GitHub-Commit-Fetcher/1.3 and 1.4, GitHub-Event-Fetcher/2.2). It repeatedly targeted private repository commit paths across dozens of accounts within minutes. In one confirmed case, a client using the repo-dumper user agent accessed private repositories through a mix of git.clone and api.request events to private paths, indicating successful exfiltration of source code. The tool GitHarvester is also named in the source. Infrastructure is associated with 3xK Tech (with a history of abuse) and cherryservers.com.

Relevant GitHub audit log events are api.request, git.clone and repo.download_zip. Datadog recommends enabling audit log streaming, baselining legitimate user agents, hunting on programmatic access type (OAuth, classic PAT, fine-grained PAT), user agent anomalies (fake version strings such as /1.0), source ASN, and successful access to private resources. No CVE is involved and no single actor is attributed. Severity is analyst-assigned.

## MITRE ATT&CK

- T1595 Active Scanning
- T1593.003 Code Repositories
- T1589 Gather Victim Identity Information
- T1585.001 Social Media Accounts
- T1583.003 Virtual Private Server
- T1528 Steal Application Access Token
- T1078.004 Cloud Accounts
- T1550.001 Application Access Token
- T1087.004 Cloud Account
- T1213.003 Code Repositories
- T1119 Automated Collection

## Sources

- [Coordinated GitHub API enumeration and access token abuse (Datadog Security Labs)](https://securitylabs.datadoghq.com/articles/coordinated-github-api-enumeration/)
- [Coordinated GitHub API enumeration (Datadog Security Labs, markdown)](https://securitylabs.datadoghq.com/articles/coordinated-github-api-enumeration.md)
- [Coordinated GitHub API Enumeration and Access Token Abuse (Wiz Threats)](https://threats.wiz.io/all-incidents/coordinated-github-api-enumeration-and-access-token-abuse)
- [Ghost Accounts Abuse GitHub API in Mass Recon Campaign (SecurityWeek)](https://www.securityweek.com/ghost-accounts-abuse-github-api-in-mass-recon-campaign/)
- [Hackers Turn Dormant GitHub Accounts for Recon (Cyber Security News)](https://cybersecuritynews.com/hackers-turn-dormant-github-accounts-for-recon/amp/)
- [Datadog Warns of Coordinated GitHub API Enumeration Campaigns Targeting Organizations (TechNadu)](https://www.technadu.com/?p=630739)
- [Datadog says months-long GitHub recon out of dormant ghost accounts is prep for supply chain (DEV Community)](https://dev.to/leobaniak/datadog-says-months-long-github-recon-out-of-dormant-ghost-accounts-is-prep-for-supply-chain-34n3)
- [Coordinated GitHub API Enumeration and Token Abuse (detections.ai Intel Exchange)](https://detections.ai/intel-exchange/019f4248-3ab7-76cd-9903-568d5e18e882)
- [GitHarvester source repository](https://github.com/metac0rtex/GitHarvester)
- [GitHarvester (Pentest Reports tool listing)](https://pentestreports.com/tool/githarvester)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4551