● Covered by 2 sources · 2 reportsMedium impact
Attackers Use Dormant GitHub Accounts for Reconnaissance via API
Key points
- Attackers exploit dormant GitHub accounts for recon campaigns.
- Data collected includes organizations, repos, user accounts.
- Campaigns used automated tools and exploited leaked credentials.
- Activity ongoing for months, with potential for future attacks.
Overview
Datadog Security Labs reported that attackers are actively exploiting dormant GitHub accounts to conduct detailed reconnaissance of corporate organizations. These campaigns involve using the GitHub API to collect data on organizations, repositories, and user accounts.
Methodology
The campaigns utilize accounts that were registered two to five years ago and left dormant. Attackers leverage automated tools and both legitimate and ghost accounts to blend in with normal API traffic. Leaked credentials, such as personal access tokens, further facilitate unauthorized access.
GitHub's API allows queries of its public data, and attackers exploit this, performing enumeration without triggering authentication alerts. In some cases, this has resulted in cloning of private repositories.
Implications
These reconnaissance activities raise significant security concerns as they provide attackers with detailed mappings that can be used for future targeted breaches. This method of blending with legitimate traffic makes detection challenging, increasing the risk for organizations unaware of this activity.
Call to Action
Organizations should be vigilant about their GitHub security practices, monitoring for unusual activity and securing all credentials. Proactive steps can mitigate the risk posed by these dormant account exploitation campaigns.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
How outlets covered it
Threat actors are using dormant ghost accounts to exploit the GitHub API for mass organization enumeration. This activity has raised security concerns as it enables detailed reconnaissance, potentially laying the groundwork for future attacks.
Datadog Security Labs has reported multiple campaigns targeting corporate GitHub organizations using outdated or ghost accounts. Attackers utilize this method to bypass scrutiny while gathering sensitive organizational data and have successfully cloned private repositories in certain instances.