GitHub Organization Enumeration via Dormant and Compromised Accounts

Technical Analysis

The campaigns leverage automated scraping tools with custom or legitimate-sounding user agents to query the GitHub API at scale, enumerating organization membership, repository structures, and user metadata without triggering typical abuse detection thresholds. Attackers use long-dormant GitHub accounts (some years old) and stolen or abused OAuth tokens and personal access tokens (PATs) to authenticate, allowing higher API rate limits and reduced suspicion compared to anonymous or newly created accounts. This reconnaissance likely feeds follow-on operations such as targeted phishing, credential stuffing against identified maintainers, or supply-chain package/dependency compromise. Because many organizations store CI/CD secrets, API keys, and package publishing credentials in GitHub, this enumeration activity increases risk of downstream compromise of packages and integrations commonly consumed by AI agent frameworks, RAG pipelines, and LLM tool-use dependencies, meaning a successful follow-on supply-chain attack could poison packages that autonomous agents install or execute.

Affected Systems

GitHub Enterprise and GitHub.com organizations; repositories and user accounts accessible via GitHub REST/GraphQL API; OAuth applications and personal access tokens with read/org-scope permissions

Indicators of Compromise

• Anomalous GitHub API request patterns from dormant accounts (multi-year-old accounts with sudden activity)
• Unusual OAuth token usage from unfamiliar IP ranges/ASNs
• High-volume enumeration requests against org/repo/user endpoints
• Custom or spoofed User-Agent strings mimicking legitimate scraping tools

Remediation Steps

1. 1

   Audit OAuth Tokens and PATs

   Review all active OAuth application authorizations and personal access tokens for organization repositories; revoke unused, dormant, or overly-privileged tokens.

2. 2

   Enable GitHub Audit Log Monitoring

   Monitor GitHub organization audit logs and API access patterns for anomalous enumeration behavior, especially from dormant or long-inactive accounts.

3. 3

   Enforce SSO and MFA

   Require SAML SSO and mandatory two-factor authentication for all organization members to reduce risk from compromised credentials.

4. 4

   Restrict Token Scopes and Lifetimes

   Adopt fine-grained personal access tokens with minimal scopes and short expiration windows instead of classic broad-scope tokens.

5. 5

   Deactivate Dormant Accounts

   Identify and offboard or suspend long-inactive user accounts and bot accounts that no longer require organization access.

6. 6

   Review CI/CD and Package Publishing Secrets

   Rotate secrets and API keys stored in repository settings, GitHub Actions, and package registries that could be exposed through enumeration, particularly those consumed by automated agent or pipeline tooling.