The quiet threat of ‘ghost’ accounts
When a GitHub account sits untouched for years, most teams assume it’s harmless. A forgotten developer profile, an old bot, a test user — nothing to worry about, right?
Wrong. According to Datadog Security Labs, attackers are actively weaponizing these dormant accounts. They call them ‘ghost’ accounts, and they’re a core part of a broader campaign to map out corporate GitHub organizations, repositories, and user accounts without raising alarms.
The technique is deceptively simple: automated scripts scrape the GitHub API using custom user agents that sound legitimate. The accounts themselves are often years old — meaning they pass basic age checks and don’t trigger the suspicion a fresh profile would.
How the enumeration works
Datadog’s report details several overlapping campaigns, all targeting the same thing: organizational structure. Attackers aren’t after code — at least not yet. They want the map.
By making API calls to list members of an organization, pull repository metadata, and check user profiles, they can build a detailed picture of who works where, what projects exist, and which accounts have elevated access. That reconnaissance is gold for a follow-up phishing attack or a credential-stuffing attempt.
OAuth tokens in the mix
It gets worse. Some of these campaigns don’t rely on ghost accounts at all. Instead, they use compromised OAuth tokens — keys that were either stolen or leaked — to authenticate as a legitimate user. Once inside, the attacker can scrape even more data because the API trusts the token.
This is a classic GitHub API abuse scenario: the API itself is working as designed. The problem is that the credentials behind the requests are not what they seem.
Why old accounts fly under the radar
Security teams often focus on new accounts and unusual login locations. A dormant GitHub account that suddenly starts making API calls? That’s harder to catch. The account already exists. It might have a history of commits, comments, or issues. The behavior shift is subtle.
Add in custom user agents that mimic popular tools like curl or official GitHub CLI clients, and you have a recipe for invisibility. The traffic looks normal. The account looks normal. Only the intent is malicious.
What organizations should do
There’s no single fix, but Datadog points to a few concrete steps that reduce the risk significantly:
- Audit OAuth tokens regularly. Revoke any token that hasn’t been used in 90 days. Attackers love old, forgotten tokens.
- Monitor API call patterns. A sudden spike in member enumeration or repository listing from a single account — especially an old one — is worth investigating.
- Enforce two-factor authentication (2FA). It won’t stop a compromised token, but it makes ghost account takeovers much harder.
- Review organization membership. Remove users who no longer work on the project. Every extra account is a potential entry point.
For more on securing your development pipeline, check out our guide on GitHub security best practices and how to handle compromised API tokens.
The bottom line
Attackers are getting smarter about blending in. They’re not smashing the front door — they’re using keys that were left under the mat years ago. Dormant GitHub accounts, old tokens, and legitimate-looking traffic are the new normal in corporate reconnaissance.
The takeaway? Clean up your digital attic. Every old account and every unused token is a liability. And in this case, the ghosts are very real.
