Coordinated GitHub API Enumeration and Access Token Abuse (Campaign)

Datadog Security Labs identified multiple coordinated campaigns abusing GitHub APIs and legitimate credentials (including dormant 'ghost' accounts and valid PATs/OAuth tokens) to systematically enumerate organizations, repositories, users, and development activity at scale; although much of the activity focused on public-repo reconnaissance, some cases of compromised credentials allowed unauthorized access to private repositories, increasing supply-chain and intelligence-gathering risk on GitHub.