Phantom accounts and exposed tokens: the silent mass mapping that takes advantage of the GitHub API

Datadog Security Labs has identified coordinated campaigns that are using the GitHub API to map organizations, repositories and user accounts for mass recognition purposes. Although much of the activity takes advantage of public endpoints, attackers have combined automated tools, seemingly inactive old accounts - which I will call ghost accounts- and legitimate tokens committed to carry the investigation beyond what would normally be expected of casual scrapping.

The main tactic is deliberately simple and effective: using accounts created years ago and without continued activity to issue API requests that do not awaken immediate suspicion. When operating with credible user agents and tokens exposed, traffic is mixed with legitimate use. Recurrent consultations include the list of public repositories of an organization, the exploration of followers and followed by users, the listing of gists and stars, and the sending of GraphQL consultations to extract metadata. In some reported incidents, private repositories were cloned after finding credentials with sufficient permits.

This poses a double problem: on the one hand, the large public area of the GitHub API facilitates automated recognition; on the other, the use of old accounts and legitimate tokens makes it difficult to detect based on simple signatures or automatic rejection of new accounts. The real risk is data accumulation: hundreds or thousands of requests that together allow an attacker to map internal project structures, taxpayers' relationships and potential vectors for subsequent attacks.

The implications are broad. Beyond direct exposure of code or intellectual property, aggregated information can facilitate targeted social engineering attacks, compromise the supply chain by identifying repositories with critical dependencies, or allow side movements if credentials are discovered with inadequate permits. Even if most requests consume public data, the shift to cloning of private repositories shows that a small number of filtered credentials can scale the impact.

Detecting such campaigns requires approaches that focus on added behaviour rather than on isolated signals. Warning signs include multiple accounts that carry out similar and synchronized consultations against several organizations, intensive pay patterns, repetitive use of certain apparently legitimate user-agents, and simultaneous clone or download peaks. Reviewing audit records and correlating them with external sources is key to identifying this behavior before it results in exfiltration.

In practical terms, organizations can and should take concrete measures to reduce the exposure area. Among the most effective actions are enable multifactor authentication and SAML / SSO required for members of the organisation, impose policies for the expiry and rotation of tokens, apply the principle of minor privilege by means of restricted-scope tokens (fine-grained PATs) and revoke unnecessary access or inactive accounts. In addition, it is recommended to activate the scanning of secrets and the protection of branches, and to limit access to third-party OAuth applications by regular reviews.

From a monitoring perspective, companies should integrate GitHub's log with their IMS, establish alerts for mass listing patterns and clones of sensitive repositories, and evaluate the adoption of tools that detect unusual synchronization between multiple accounts. It is also appropriate to regularly audit the lists of members and external partners, and to use controlled barley repositories to measure suspicious activity without exposing real assets.

For developers and technical equipment, the specific recommendations pass by not storing tokens in repositories or in histories, using environment variables and secret managers, preferring authentication methods with simple expiry and revocation, and setting minimum permissions for GitHub Actions and for each workflow. Review authorized integrations and applications and limit public webhooks reduces operating vectors.

This type of threat recalls that security on collaborative platforms requires both technical controls and continuous governance: clear access policies, periodic reviews and telemetry to see aggregate patterns. To deepen good security practices in GitHub and how to manage tokens and authentication consult GitHub's official documentation at https: / / docs.github.com / en / authentication / keeping-your-account-and-data-secure and the threat analysis and publications of Datadog Security Labs in https: / / www.datadoghq.com / blog / category / security / providing additional context and technical examples.