Dormant GitHub Accounts Help Attackers Blend In While Mapping Corporate Orgs

Summary: Datadog Security Labs reported several overlapping campaigns that enumerate corporate GitHub organizations, repositories, and user accounts through the GitHub API, using automated scraping tools, more than 50 dormant "ghost" accounts created two to five years ago, and dozens of legitimate accounts whose personal access tokens were exposed or compromised. Most activity targeted public data, but in select cases attackers cloned a private repository belonging to a single organization.
What you should know: The ghost accounts were left inactive for years before use specifically so the traffic would pass as legitimate, and because much of GitHub's API is reachable without authentication, individual requests look unremarkable - the signal only appears in the aggregate of accounts moving in sync across companies over weeks.

Read the original at The Hacker News ↗