Datadog Warns of GitHub Enumeration Campaigns Using API
Rotate all GitHub tokens, enforce least‑privilege scopes, enable audit logs, and monitor for automated scraping activity.
Rotate all GitHub personal access tokens, restrict scopes to the minimum required, enable audit logs, and implement rate limiting or IP whitelisting for API access.
Summary
Datadog Security Labs has warned of several overlapping campaigns that systematically enumerate corporate GitHub organisations, repositories, and user accounts through the GitHub API. Operators rely on automated scraping tooling with custom or legitimate‑sounding user agents, leveraging ghost accounts that are often years old, or compromised OAuth tokens and personal access tokens. The enumeration process gathers metadata and potentially sensitive information across thousands of repositories. The campaigns exploit GitHub’s API rate limits and lack of strict access controls, allowing attackers to map organisational structures and identify high‑value targets. The warning underscores the need for tighter API security and monitoring. It also recommends rotating tokens, restricting scopes, and enabling audit logs. Immediate action is required to protect exposed GitHub assets from automated enumeration.
Key changes
- Datadog Security Labs warns of overlapping campaigns enumerating GitHub orgs, repos, user accounts via GitHub API
- Attackers use automated scraping tooling with custom or legitimate‑sounding user agents
- They leverage ghost accounts that are often years old, or compromised OAuth tokens and personal access tokens
- The enumeration targets corporate GitHub organisations, repositories, and user accounts
- The campaigns systematically gather metadata and potentially sensitive information
- Attackers exploit GitHub API rate limits and lack of strict access controls
- The warning highlights the need for tighter API security and monitoring
- It suggests rotating tokens and restricting scopes