Coordinated GitHub API enumeration and access token abuse

Datadog Security Research has observed coordinated campaigns abusing GitHub API to enumerate corporate organizations, repositories, and user accounts. Attackers use ghost accounts, compromised tokens, and custom scraping tools with legitimate-sounding user agents to gather public data and, in some cases, access private repositories. The activity includes reconnaissance via GraphQL and REST endpoints, with rare instances of confirmed data exfiltration. Detection is challenging due to legitimate-looking traffic, but indicators such as suspicious user agents and token types can help identify malicious behavior.

AI-extracted · verify before operational use