Threat actors are conducting mass reconnaissance campaigns against GitHub organizations by abusing the GitHub API using ghost accounts—accounts created 2 to 5 years ago and left dormant. These accounts send bursts of API requests targeting publicly accessible data such as organization repositories, members, followers, gists, and starred repositories, primarily via GraphQL queries and REST API calls. The requests generate normal HTTP 200 responses and do not require authentication, allowing attackers to map organizations and their members without raising immediate alarms. Some campaigns also used leaked tokens from legitimate users to access private repository commit paths, leading to rare cases of data exfiltration. The campaigns use user agents mimicking legitimate analytics or dashboard tools to evade detection. Detection recommendations include enabling GitHub audit log streaming, baselining user agents, and proactive threat hunting tailored to GitHub environments.

The primary impact is unauthorized reconnaissance of GitHub organizations, including mapping of public repositories, members, and organizational structure. While most activity is limited to publicly available data, some campaigns have escalated to cloning repositories and, in rare instances, exfiltrating data from private repositories using leaked credentials. This can lead to exposure of sensitive source code or intellectual property. The activity may also facilitate further targeted attacks by providing attackers with detailed organizational insights.

Patch status is not applicable as this activity exploits publicly accessible API functionality without a software vulnerability. Mitigation focuses on detection and monitoring: enable GitHub audit log streaming to capture detailed API usage; baseline normal user agent behavior to identify anomalous or suspicious user agents; proactively hunt for unusual API request patterns, especially those targeting private repositories; and monitor for data exfiltration from private repositories. Organizations should also review and revoke any inadvertently exposed or leaked GitHub tokens. No official fix or patch is available since the API behavior is by design.