Coordinated GitHub API enumeration and access token abuse

Datadog Security Research observed sustained, coordinated abuse of the GitHub API where networks of long-dormant 'ghost' accounts and stolen OAuth/PAT tokens systematically enumerated organizations, users, and repositories (primarily via /graphql and other public endpoints); while most activity was reconnaissance of public data, the campaign included attempts to access private repo commit paths and at least one confirmed private-repo clone. The report provides lists of suspicious user agents and hosting providers, targeted API routes, example actor naming patterns, and Datadog hunting queries to detect programmatic access to private resources.