Executive Summary
Datadog Security Research is tracking a series of overlapping campaigns targeting GitHub organizations through systematic API enumeration. These activities involve a mix of automated scanners, compromised Personal Access Tokens (PATs), and a network of 'ghost' accounts—dormant profiles created years ago and recently activated to blend in with legitimate traffic. While much of the activity focuses on public data reconnaissance, researchers have confirmed instances where attackers successfully crossed into private repository exfiltration.
The technical execution relies heavily on versioned custom tooling and automated scripts that mimic legitimate analytics or dashboard services. Attackers focus on mapping organization structures, member relationships, and repository metadata before attempting to clone private code bases. The use of hosting providers like 3xK Tech and Cherry Servers has been associated with these campaigns, which show a high degree of automation and coordination across multiple target organizations simultaneously.
This activity represents a significant risk to intellectual property and secrets management. Successful exfiltration of private repositories can lead to the exposure of proprietary source code and hardcoded credentials. Organizations should immediately baseline their GitHub API traffic, focusing on anomalous user agents and unauthorized access to private repository paths.