Coordinated GitHub API Abuse Enabled Enterprise Reconnaissance and Private Repo Access

Datadog Security Research reported sustained campaigns abusing GitHub’s public and authenticated APIs to enumerate enterprise organizations, repositories, and users while blending into normal developer traffic. The activity relied on automated scraping through endpoints including /graphql, dormant “ghost” GitHub accounts, and in some cases compromised OAuth tokens or personal access tokens. Researchers identified more than 50 ghost accounts since October 2025, along with recurring user agents such as GitHub-Company-Scraper, GitHub-Scraper-Tool/1.0, GitHubAnalytics/1.5, GitHub-Commit-Fetcher/1.3, GitHub-Commit-Fetcher/1.4, and GitHub-Event-Fetcher/2.2, with some infrastructure linked to 3xK Tech.

While much of the traffic queried public data and appeared benign in isolation, researchers said the aggregate behavior amounted to coordinated reconnaissance that could support later theft of secrets, repository cloning, or broader intrusion activity. In a more serious observed case, a tool identified as repo-dumper successfully cloned or accessed a private repository, with GitHub audit logs showing git.clone and api.request events against private paths. Defenders were urged to baseline GitHub audit activity and hunt for unusual user agents, actor names, token types, source ASNs, and successful access to private resources, while also enforcing MFA, conducting access reviews, enabling audit log streaming, and using repository secret scanning.