When Old Ghosts Come Back to Haunt Your Code

According to a report from The Hacker News, attackers are using GitHub accounts that have been sitting idle for two to five years to quietly map out corporate organizations. These so-called "ghost" accounts scrape public information like repository lists, member profiles, and follower connections through the GitHub API.

What makes this tactic so dangerous is that the accounts look completely normal. They were created years ago, never used, and then suddenly spring to life. Because the activity blends in with regular API traffic, security teams often miss it until it's too late.

Why This Blended Attack Matters More Than You Think

This isn't just about someone looking at public code. The real risk is that attackers use this reconnaissance to build a detailed map of a company's developers, projects, and relationships. Once they know who works on what, they can target specific people with phishing or credential theft.

In some cases, the report notes that attackers moved beyond just looking at public data and actually cloned private repositories. That's a data breach waiting to happen. For Australian businesses, this is a wake-up call that even public development platforms can be a threat vector.

Attackers are getting smarter about flying under the radar. They don't need zero-day exploits when they can simply abuse existing trust and access patterns. The "old account" trick is especially hard to spot because most monitoring tools only look for suspicious new accounts, not dormant ones suddenly waking up.

What This Means for Australian SMBs

Small and mid-sized businesses often have fewer security resources than big corporations. Many Australian SMBs use GitHub for internal projects, client work, or managing code for their own products. If an attacker clones a private repository containing customer data or business logic, the damage could be severe.

Australian businesses also face strict data breach notification laws under the Notifiable Data Breaches scheme. A cloned repo with personal information would trigger mandatory reporting, legal costs, and a hit to reputation. This attack method shows that cybersecurity isn't just about firewalls and antivirus—it's about monitoring how your team uses cloud-based development tools.

What You Can Do Now

  • Audit your GitHub organization for any API tokens that are still active but no longer used. Revoke them immediately.
  • Set up alerts for unusual API traffic patterns, like a specific old account making hundreds of requests in a short time.
  • Restrict access to private repositories by reviewing who has permissions and removing ex-employees or contractors.
  • Enable two-factor authentication (2FA) for every developer account to reduce the risk of compromised tokens.
  • Train your team to recognize that even "public" information on GitHub can be used against them—keep internal discussions off public repos.

At MS&VG, we help Australian SMBs build practical cybersecurity strategies that address real-world threats like these. If you’re unsure how to protect your GitHub environment or need a security review, reach out—we’re here to help you stay safe.