Ghost GitHub accounts silently map orgs, exposing private repos
Datadog Security Labs uncovered coordinated campaigns that wield dormant "ghost" GitHub accounts and compromised tokens to mass‑enumerate orgs, repos, and members via the public API. The low‑profile traffic blends with legitimate requests, but at scale it creates a detailed reconnaissance map that can lead to private‑repo theft. Defenders can hunt the behavior by flagging suspicious user agents, token types, and ASN patterns.