# Coordinated GitHub API enumeration and access token abuse

DevFeed: [Coordinated GitHub API enumeration and access token abuse](<https://devfeed.tech/articles/coordinated-github-api-enumeration-and-access-token-abuse-8283.md>)

Original publisher: [Read original article](<https://securitylabs.datadoghq.com/articles/coordinated-github-api-enumeration/>)

Author: Julie Agnes Sparks

Published: 2026-07-08T00:00:00Z

Content type: article

Language: en

Sources: [Datadog Security Labs](<https://devfeed.tech/sources/datadog-security-labs.md>)

Topics: [GitHub](<https://devfeed.tech/topics/github.md>), [GitHub API](<https://devfeed.tech/topics/github-api.md>), [Security](<https://devfeed.tech/topics/security.md>), [API](<https://devfeed.tech/topics/api.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [OAuth](<https://devfeed.tech/topics/oauth.md>), [GraphQL](<https://devfeed.tech/topics/graphql.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [auth](<https://devfeed.tech/tags/auth.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [github](<https://devfeed.tech/tags/github.md>), [networks](<https://devfeed.tech/tags/networks.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [security](<https://devfeed.tech/tags/security.md>), [tokens](<https://devfeed.tech/tags/tokens.md>), [tooling](<https://devfeed.tech/tags/tooling.md>)

## AI overview

Datadog Security Research describes coordinated campaigns abusing the GitHub API to enumerate organizations, repositories, and users. The activity combines automated scraping, ghost accounts, compromised OAuth tokens, and personal access tokens; in some cases, attackers progressed from public-data enumeration to cloning private repositories.

## Source excerpt

Datadog Security Research has tracked multiple coordinated campaigns enumerating GitHub organizations, repositories, and users through the public GitHub API, abusing leaked access tokens, and cloning private repositories.