Research has uncovered coordinated campaigns that use more than dormant GitHub accounts<\/a> to map corporate organizations, repositories, and developers.<\/p>\n The activity relies on GitHub\u2019s API to collect public information. However, some operators have also attempted to access private source code repositories and, in rare cases, succeeded.<\/p>\n The campaigns have been active since at least October. Rather than involving a single threat actor, the researchers observed multiple overlapping operations that used automated tools, compromised access tokens, and networks of long-dormant \u201cghost\u201d accounts.<\/p>\n Many of the accounts were created two to five years ago. They remained inactive until they suddenly began making API requests across several GitHub organizations.<\/p>\n This aging strategy may help attackers appear more legitimate than newly created accounts used for mass scraping.<\/p>\n The accounts followed recognizable naming patterns, including the amazon-data-* prefix, the *-orb family, and repetitive usernames such as BirdWithDreams, BirdWithPlan, user432023, and user412023.<\/p>\n Datadog confirmed that more than such accounts participated in reconnaissance activity, often operating for only one to three weeks before going quiet.<\/p>\n The attackers primarily queried GitHub\u2019s \/graphql endpoint, which supports bulk requests for organization, user, and repository information.<\/p>\n They also used REST API routes to list public repositories, organization memberships, followers, gists, starred projects, and user activity.<\/p>\n Because much of this data is public, the requests often return successful HTTP responses. They may appear to be legitimate use of the GitHub API.<\/a><\/p>\n Attackers can use this information to build a detailed picture of a company\u2019s developers, projects, technology stack, open-source exposure, and potential targets for further compromise.<\/p>\n Several campaigns used suspicious user-agent strings, including GitHub-Company-Scraper, GitHub-Scraper-Tool\/1.0, and GitHubAnalytics\/1.5.<\/p>\n Other tools attempted to appear legitimate by using names linked to analytics, dashboards, monitoring, or repository analysis.<\/p>\n One campaign used the simple request user agent, which stands out from the more common versioned tool names. Datadog also identified activity involving stolen OAuth tokens<\/a> and personal access tokens.<\/p>\n Between late December and early January, the credentials of dozens of legitimate GitHub users were compromised and used to access a single organization within minutes.<\/p>\n The operators cycled through user agents such as GitHub-Commit-Fetcher\/1.3, GitHub-Commit-Fetcher\/1.4, and GitHub-Event-Fetcher\/2.2.<\/p>\n These requests attempted to list repositories, retrieve commit data, and access private repository paths.<\/p>\n While many private repository requests failed, Datadog documented one confirmed incident<\/a> in which a tool identified as repo-dumper successfully executed git clone and API actions against a private repository.<\/p>\n The campaign highlights how public GitHub metadata can support corporate reconnaissance before attackers attempt credential abuse or source code theft.<\/p>\n Security teams should enable GitHub audit log streaming and establish a baseline of normal API activity in their environments.<\/p>\n Defenders should investigate successful API requests, Git clone operations, and ZIP downloads involving private repositories, especially when OAuth tokens or personal access tokens are used.<\/p>\n Key signals include unusual user agents, unexpected account activity, suspicious token types, abnormal request volume, and source infrastructure linked to hosting providers such as 3xktech[.]cloud and cherryservers[.]com.<\/p>\n Stop Accepting SLAs Written for 2019 SOCs \u2013 Here\u2019s the 2026 AI SLA Vendor<\/strong> Checklist<\/strong> \u2013 Download Free AI SOC SLA <\/strong>Guide<\/a><\/strong><\/p>\n The post Hackers Turn 50+ Dormant GitHub Accounts Into a Network for Corporate Source Code Recon<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\nHackers Hijack GitHub Accounts for Recon<\/strong><\/h2>\n
![\"Attack](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhcUX_gjOtaeM8VbvJEoFB_yhFkqaVTBSuL-boolee6Jvzryrr9uJXXiPuVb5YTr1aDIc6TXi80ZuOn7qFIBTyC6ZY3rOjjcrDkeqm8Fv-od_H_wibiNJUAfCPf_9a6mJ1MkFXYRJn_fEOpI46DgxepBFFbX6GKtkPI1YKhxUmyf1kJeabEnQiOLywLOO0\/s1600\/Screenshot%25202026-07-10%2520122938%2520%25281%2529.webp?ssl=1\")
![\"BirdWithPlan](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEghyphenhyphenayU-re-BtGcaeriGxcc_F1CcZjtQmwkkzLqUKxi44C9bwWcp_o2HIXWh6FkmLz_3jVOBWXH6s3Vb3gJqBQPf0PVJECMA6iawky-71mKRkIiIiw68riVxZyyIRZ1aDDRjaNH_XPofT7-o4Ig9qyhW7NnCmbP2C7w8oUdb0D9vujdo1hr9gnkUDlWIl4\/s1600\/Screenshot%25202026-07-10%2520123010%2520%25281%2529.webp?ssl=1\")