Dormant GitHub accounts enable sustained org mapping and selective private repo cloning

Datadog Security Labs documented multiple campaigns using custom scanners and compromised PATs to enumerate public repositories, followers, gists, and org memberships via unauthenticated endpoints and GraphQL. Activity blends into normal traffic because requests target public surfaces and use aged accounts rather than fresh creations. The aggregate pattern across weeks reveals synchronized movement between organizations that individual logs would miss.

This technique extends known developer-platform abuse seen in prior token leaks and supply-chain incidents such as Codecov (2021) and the 2023 GitHub Actions artifact compromises. Dormant accounts reduce behavioral flags that GitHub's existing rate-limit and new-account heuristics catch. Once mapping identifies maintainers and private repo structures, actors shift from enumeration to cloning, crossing the line from reconnaissance to direct data access.

GitHub's API design and the prevalence of exposed PATs create persistent surface area. Expect targeted follow-on activity against identified high-value repositories within 30-60 days as actors prioritize cloned material for further credential harvesting or dependency injection.