Ghost GitHub Accounts Used to Map Corporate Orgs

Datadog Security Labs warns of campaigns using dormant GitHub accounts to enumerate corporate organizations, repos, and users via the API. Attackers leverage years-old 'ghost' accounts or compromised OAuth tokens to blend in. The automated scraping uses custom or legitimate-sounding user agents to avoid detection.