Threat actors are executing coordinated reconnaissance campaigns against corporate entities by leveraging "Ghost Accounts"—dormant GitHub profiles aged 2-5 years designed to bypass heuristic-based detection of new "burner" accounts. The attack utilizes a two-stage methodology: initial unauthenticated mapping of organizational social graphs via public GraphQL and REST API endpoints, followed by a high-velocity exfiltration phase. During this second phase, attackers utilize "Identity Dark Matter"—compromised OAuth tokens and Personal Access Tokens (PATs)—to pivot from public data to private repository cloning. This approach effectively evades traditional rate-limiting and anomaly detection by mimicking legitimate developer telemetry and leveraging high-abuse infrastructure like 3xK Tech.

• Campaign Overview: Strategic Reconnaissance

  • Exploitation of aged, dormant GitHub profiles (2-5 years old) to establish perceived legitimacy.
  • Goal-oriented mapping of corporate engineering structures, developer identities, and social graphs.
  • Leveraging high-abuse hosting providers, specifically 3xK Tech, to blend with legitimate traffic.

• Attack Mechanics: Two-Stage Execution

  • Phase I (Mapping): Quiet, unauthenticated enumeration using the public GitHub API and GraphQL to build detailed organizational dossiers.
  • Phase II (Exfiltration): A "smash and grab" transition using compromised OAuth and Personal Access Tokens to access private repositories.
  • Evasion via identity rotation, making malicious activity appear as legitimate employee surges or internal telemetry.

• Technical Indicators: Detection Artifacts

  • Suspicious User-Agents: Identifiers include GitHubAnalytics/1.5, GitHubReporter/2.0, GitHub-Insights/3.2, repo-dumper, and GitHub-Commit-Fetcher/1.4.
  • Primary API Targets: Excessive querying of /graphql, /organizations/:organization_id/repos, and user-specific endpoints (followers, following, starred).
  • Account Naming Conventions: Patterns such as amazon-data-*, *-orb suffixes (e.g., kuku-orb), and avian-themed strings like BirdWithPlan.

• Security Gaps: Detection Evasion

  • API Design Exploitation: Use of "Public by Design" routes that return HTTP 200 OK, rendering failed-event monitoring ineffective.
  • Heuristic Bypass: Traditional security controls focused on new account creation fail to flag these long-standing, legitimate-looking identities.
  • Identity Dark Matter: Successful pivoting from public reconnaissance to private data access via high-density, multi-account token abuse.

• Defense & Mitigation: Strategic Response

  • Shift monitoring focus from account age/reputation to behavioral anomalies within organizational API telemetry.
  • Implement strict scoping and regular rotation for Personal Access Tokens (PATs) to limit the blast radius of "Identity Dark Matter."
  • Enhance detection for unusual GraphQL query patterns and bulk enumeration attempts targeting organizational structures.