Dormant GitHub Accounts Help Attackers Blend In While Mapping Corporate Orgs

Datadog Security Labs reports overlapping campaigns that programmatically enumerate GitHub organizations, repositories, users, gists, and related metadata via the GitHub API using aged dormant 'ghost' accounts, compromised personal access tokens/OAuth tokens, and automated tooling; while much of the activity targets public endpoints, investigators confirmed instances where attackers cloned private repositories, indicating limited successful data access.