Reconnaissance is the foundation of any targeted attack. When adversaries want to map your infrastructure, they need to gather information without triggering obvious alarms. A recent trend in API-based attacks shows how attackers are using years-old, dormant GitHub accounts and compromised OAuth tokens to systematically enumerate corporate GitHub organisations, repositories, and developer accounts.
The Enumeration Pattern
According to Datadog Security Labs reporting, multiple coordinated campaigns are leveraging the GitHub API to build a comprehensive map of corporate infrastructure. The technique is straightforward: operators use automated scraping tools with deliberately innocuous or legitimate-sounding user agents, making their activity blend into normal API traffic.
What makes this effective is the choice of accounts. Rather than using freshly created GitHub accounts—which might raise suspicion—attackers reactivate ghost accounts that have been dormant for years, or they use compromised OAuth tokens obtained through credential theft or phishing. To GitHub's systems, these requests appear to originate from legitimate long-standing user accounts or authenticated applications, bypassing rate-limiting that typically applies to anonymous API calls.
The goal is straightforward intelligence gathering. By enumerating repositories, organisations, and user accounts through API queries, attackers build a detailed picture of: which services a company depends on, the structure of their development teams, how code is organised across repositories, and potentially which projects are critical or under active development.
Why This Works at Scale
GitHub's API is designed to be accessible—that's the point of a platform for collaborative development. Rate limits exist, but they're generous for authenticated requests. A dormant account from 2015 that's suddenly making hundreds of API calls per hour may not immediately trigger alerts, especially if the requests are spread across different endpoints and repositories.
The attacker's perspective is pragmatic: reconnaissance at this stage is passive. They're not modifying code, accessing secrets, or deploying anything. They're simply asking GitHub's API to tell them what exists. From the platform's point of view, this is indistinguishable from a legitimate developer exploring public repositories or an automation script checking build status.
For organisations using GitHub as their primary development platform—which is most of them—this is a significant problem. Your repository structure, team size, technology choices, and project priorities are effectively public information once an attacker has invested time in systematic enumeration.
Detection and Response
Several defensive measures are practical. First, audit your OAuth token grants and revoke any that haven't been used recently or that belong to applications you no longer run. Personal access tokens should be rotated regularly and scoped to the minimum permissions necessary.
Second, monitor API activity patterns for your organisation. Look for sustained, high-volume queries from a single user account, particularly if that account hasn't made commits or activity in months. GitHub's audit logs record API access; reviewing them for anomalies is labour-intensive but worthwhile for organisations handling sensitive infrastructure.
Third, consider what information you're exposing. Make sensitive repositories private, even if they contain no secrets—the structure itself can be valuable to an attacker. Review which repositories are visible to organisation members and which are truly public. A repository that's "unlisted" is still enumerable via API; visibility settings and access control are different things.
Finally, assume that your repository structure is already known to patient adversaries. Focus security effort on what matters: ensuring that secrets are never committed (use secret scanning tools), that access controls are properly enforced, and that your deployment infrastructure is protected regardless of whether someone knows it exists.
The Broader Infrastructure Angle
For teams managing hosted infrastructure—whether shared hosting, VPS, or dedicated servers—the lesson is similar. Enumeration precedes exploitation. Attackers gathering information about your systems before launching targeted attacks is expected behaviour. The GitHub API enumeration campaigns are just one manifestation of a broader reconnaissance strategy.
Infrastructure that's designed defensively assumes that its structure may be known to adversaries. Rate limiting, access logging, and alert rules should all reflect this assumption. If you're running services that accept API connections from the internet, audit logs should capture who's connecting and what they're querying, particularly for patterns consistent with reconnaissance.
The use of dormant accounts is worth noting for any platform with user authentication. An old, inactive account with valid credentials is a sophisticated attacker's tool. It blends in, has historical weight that makes it less suspicious, and can often bypass newly-tightened security controls that weren't in place when the account was created.
Treat enumeration not as a minor information-disclosure issue, but as the first phase of an attack chain. Defence should begin there, not after an attacker has mapped your infrastructure and moved to the next phase.
