Reconnaissance is the earliest phase of any targeted attack. Mapping an organisation's public repositories, developer accounts, and infrastructure patterns gives attackers the blueprint they need before attempting infiltration. According to recent research, threat actors have refined this reconnaissance process by using a simple but effective disguise: dormant GitHub accounts that predate their actual attack campaigns by months or even years.
The Dormant Account Cover Story
Datadog Security Labs has documented systematic campaigns that enumerate corporate GitHub organisations through the GitHub API, relying on what they term 'ghost' accounts—old profiles created years ago, then left inactive until needed for reconnaissance. The logic is straightforward: an account that has existed for five years with minimal activity looks far less suspicious than a newly created one making thousands of API calls in a single session.
These ghost accounts are often paired with custom user agents designed to mimic legitimate developer tools or appear as ordinary traffic. The combination makes it harder for rate-limiting and anomaly detection systems to flag the activity as malicious. A dormant account requesting metadata about a company's private repositories looks, to many monitoring tools, like a returning employee or a legitimate third-party integrator.
API Token Compromise and Scale
Beyond resurrecting old accounts, attackers also leverage compromised OAuth tokens—credentials stolen from real developers or obtained through credential-stuffing attacks against poorly secured accounts. With a valid token, the attacker bypasses many of GitHub's basic protections and can enumerate repositories, user lists, commit history, and deployment secrets at scale.
The automated tooling these operators use is not sophisticated; it's straightforward API scraping. But scale and patience make it effective. One campaign might iterate through thousands of organisations, building a map of internal repositories, team structures, and technology stacks. This intelligence informs which targets are worth deeper investigation and where privilege escalation or lateral movement might be easiest.
Detection and Defence Gaps
Most organisations monitor for unusual login patterns or sudden API activity spikes. But a dormant account that makes requests at moderate intervals over days or weeks will often slide past those defences. The attacker's goal isn't to compromise the account itself; it's to use it as cover for information gathering.
Datadog's analysis highlights the value of monitoring API call patterns across your entire organisational perimeter, not just high-risk accounts. Legitimate users and services should establish expected API request profiles. Anything that deviates—or anything that matches the behaviour of known reconnaissance tooling—deserves scrutiny.
For organisations hosting their own infrastructure or managing sensitive deployment pipelines, the implications are clear. GitHub is often treated as a development convenience rather than a security boundary, but attackers treat it as a reconnaissance frontier. Repository names, deployment scripts, infrastructure-as-code files, and team membership lists all reveal operational details that reduce the cost and risk of a subsequent attack.
Practical Steps Forward
Enforce strong authentication and audit logging for any personal access tokens or OAuth apps with repository access. Regularly review and revoke unused tokens. Set up alerts for unusual API consumption patterns—both in terms of volume and the identity of the requester. Consider restricting repository visibility to team members only, rather than relying on public repositories for code that reveals infrastructure details.
The dormant account attack is a reminder that reconnaissance doesn't always announce itself. It works best in the margins of normal traffic, relying on the assumption that old accounts and moderate request rates won't trigger alarm. Treating GitHub enumeration as a serious reconnaissance vector, rather than background noise, is a reasonable baseline for teams managing sensitive infrastructure or applications.
