Threat actors have been conducting mass reconnaissance campaigns on GitHub organizations by abusing the GitHub API through ghost accounts—accounts created 2 to 5 years ago but left dormant. These accounts are used in bursts to enumerate public organization data such as repositories, members, followers, and starred repositories, primarily via GraphQL and REST API calls. The campaigns also leverage leaked credentials to access private repository commit paths in rare cases, resulting in data exfiltration. The reconnaissance activity generates legitimate HTTP 200 responses and mimics normal API traffic, making detection challenging. Indicators include unusual user agent strings resembling data exfiltration or analytics tools. The campaigns have been ongoing for several months, involving over 50 ghost accounts. Detection recommendations include auditing user agents, enabling audit log streaming, and threat hunting specific to GitHub API usage patterns.

The primary impact is unauthorized reconnaissance of GitHub organizations, including mapping of public repositories, members, and organizational structure. In rare instances, attackers have exfiltrated data from private repositories using exposed tokens. This reconnaissance can facilitate further targeted attacks or intellectual property theft. However, the majority of activity is limited to publicly accessible information, with limited direct compromise of private data.

Patch status is not applicable as this activity abuses legitimate GitHub API functionality and dormant accounts rather than exploiting a software vulnerability. Defenders should enable GitHub audit log streaming and baseline normal user agent behavior to detect anomalies. Monitoring for unusual user agents and unexpected access patterns to private repositories is recommended. Proactive threat hunting tailored to GitHub API usage and exposure of tokens should be conducted. Organizations should review and revoke any inadvertently exposed tokens and implement strict credential management policies.