Loading story…
Datadog Security Research reported sustained campaigns abusing GitHub’s public and authenticated APIs to enumerate enterprise organizations, repositories, and users while blending into normal developer traffic. The activity relied on automated scraping through endpoints including /graphql, dormant “ghost” GitHub accounts, and in some cases compromised OAuth tokens or personal access tokens. Researchers identified more than 50 ghost accounts since October 2025, along with recurring user agents such as GitHub-Company-Scraper, GitHub-Scraper-Tool/1.0, GitHubAnalytics/1.5, GitHub-Commit-Fetcher/1.3, GitHub-Commit-Fetcher/1.4, and GitHub-Event-Fetcher/2.2, with some infrastructure linked to 3xK Tech.
While much of the traffic queried public data and appeared benign in isolation, researchers said the aggregate behavior amounted to coordinated reconnaissance that could support later theft of secrets, repository cloning, or broader intrusion activity. In a more serious observed case, a tool identified as repo-dumper successfully cloned or accessed a private repository, with GitHub audit logs showing git.clone and api.request events against private paths. Defenders were urged to baseline GitHub audit activity and hunt for unusual user agents, actor names, token types, source ASNs, and successful access to private resources, while also enforcing MFA, conducting access reviews, enabling audit log streaming, and using repository secret scanning.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
SecurityWeek's summary of Datadog's findings says that in rare cases the GitHub API abuse campaign progressed beyond reconnaissance to successful data exfiltration from targeted organizations. This represents an escalation from the previously documented enumeration and private repository access activity.
Datadog Security Labs published research describing sustained abuse of GitHub public APIs, ghost accounts, and compromised tokens to enumerate enterprise organizations, repositories, and users. The report also recommended hunting in GitHub audit logs for suspicious user agents, actors, token types, ASNs, and private-resource access.
Datadog described a more serious case in which a user agent named repo-dumper successfully cloned or otherwise accessed a private repository. GitHub audit logs showed git.clone and api.request events against private paths, indicating confirmed access to private resources.
In late December 2025 to early January 2026, one campaign used stolen legitimate-user GitHub tokens along with versioned scraper user agents such as GitHub-Commit-Fetcher and GitHub-Event-Fetcher. Datadog linked this activity to infrastructure hosted at 3xK Tech.
Datadog reported observing more than 50 dormant "ghost" GitHub accounts used in coordinated GitHub API enumeration campaigns. The report explicitly anchors these observations as starting in October 2025, with accounts grouped by naming patterns and suspicious scraper user agents.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
securityweek.com
Open sourcecysecurity.news
Open sourcethehackernews.com
Open sourcecyberveille.ch
Open sourcesecuritylabs.datadoghq.com
Open sourceinfoworld.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that the `prt-scan` campaign abused misconfigured GitHub Actions workflows using the `pull_request_target` trigger to run attacker-controlled code from forked pull requests in privileged CI contexts. The actor used at least six GitHub accounts to submit more than 500 malicious pull requests across six waves, disguising many as routine CI updates and tailoring payloads to Python, Node.js, Go, Rust, and GitHub Actions repositories. Wiz said the operation evolved from simple bash payloads into AI-assisted, repository-aware implants designed to steal `GITHUB_TOKEN` values, enumerate secrets, probe cloud metadata services, and exfiltrate credentials through workflow logs and pull request comments. The campaign succeeded often enough to cause real supply-chain impact despite an estimated success rate below 10%. Wiz confirmed compromise of the npm packages **`@codfish/eslint-config`** and **`@codfish/actions`** across 106 versions, and verified theft of AWS keys, Cloudflare API tokens, and Netlify authentication tokens. High-profile projects including Sentry, OpenSearch, IPFS, NixOS, Jina AI, and recharts reportedly blocked the attempts through contributor approval gates and workflow restrictions. The activity follows earlier warnings from Sysdig that insecure use of `pull_request_target` in prominent repositories such as MITRE, Splunk, and Spotipy could expose secrets and high-privilege `GITHUB_TOKEN` permissions, underscoring that unsafe GitHub Actions defaults remain an active software supply-chain risk.
Jun 29, 2026
GitHub confirmed that an attacker accessed internal repositories after a malicious Visual Studio Code extension was installed on an employee device, leading to the exfiltration of roughly **3,800 GitHub-internal repositories**. GitHub said it detected and contained the intrusion, removed the malicious extension version, and isolated the affected endpoint. Independent analysis of a leaked file list reportedly found **3,874 unique** `.tar.gz` archive names, broadly matching GitHub’s estimate of the stolen data. The exposed repositories reportedly include projects tied to **security tooling, identity systems, CI/CD, infrastructure-as-code, GitHub Actions, Terraform, certificates, and Copilot-related work**, increasing the risk of follow-on supply-chain abuse and targeted social engineering. The threat actor, using the alias **TeamPCP**, is said to be offering the dataset for sale on an underground forum for more than **$50,000**, raising concerns that internal code and operational details could be weaponized against GitHub and its customers.
Jul 12, 2026
GitHub has been hit by a large-scale **repo confusion** campaign in which attackers fork legitimate projects, keep names and appearances close to the originals, and inject heavily obfuscated malicious code intended to steal passwords, cryptocurrency wallets, and other developer secrets. Apiiro reported that the operation was largely automated and tied to more than **100,000 infected repositories**, while Ars Technica said the broader attack generated **millions of malicious repositories** and exploited the difficulty users face distinguishing authentic projects from poisoned forks. Multiple GitHub repositories later carried security issues warning that **malicious code had been injected via compromised accounts**, including projects such as `django-restful-admin`, `ImportNURBS`, `siriraj-assist`, `ood_coverage`, `issued`, and `bottom-up-attention-vqa`. The notices indicate the campaign was not limited to fake lookalike repos but also reached legitimate codebases through account compromise, extending the supply-chain risk to developers who clone, fork, or build from affected repositories while GitHub continues removing abusive content through reporting, manual review, and machine-learning-based detection.
Jun 29, 2026