Researchers have warned of several overlapping campaigns that are systematically mapping corporate GitHub organizations, repositories, and user accounts through the GitHub API, using long-dormant ghost accounts to blend in, as reported by SecurityWeek and detailed by Datadog Security Labs.

Reconnaissance is the quiet first act of most intrusions, and it rarely looks like an attack. Enumerating who belongs to an organization, which repositories exist, and how they connect is all done with ordinary API calls that resemble legitimate use, which is exactly why dormant accounts make useful cover for it.

The value of the map is what comes next. Knowing an organization's structure, its developers, and its repository names gives an attacker targets for phishing, credential stuffing, and the kind of dependency and secret hunting that turns a code host into an entry point. The mapping is not the breach, it is the blueprint for one.

Defenders can make this harder by tightening what an organization exposes publicly, monitoring for unusual API enumeration patterns, and enforcing strong authentication so that a mapped account is not an easily opened one. You cannot stop someone from reading what is public, but you can make sure the map does not lead anywhere useful.

Sources: SecurityWeek; Datadog Security Labs.