GitBait Campaign

GitBaitPhishingPhaaSCredential HarvestingGitHub Pages AbuseSheetBest API

GitBait is an active, large-scale phishing operation that has targeted at least 12 banking and financial institutions in Mexico for approximately three years using a fully serverless architecture. The operation abuses GitHub Pages to host a modular, multi-brand phishing kit across more than 100 distributed domains and exfiltrates harvested credentials, client identifiers, and payment-card data through the SheetBest API into attacker-controlled Google Sheets, with a Telegram bot used as an alternative exfiltration channel for one target. Commit history reveals multiple collaborating operator accounts and continuous maintenance, including periodic rotation of the credential-collection endpoint

Indicators of Compromise

Domains (36)

support-vh.github.iosoporte-y-atencion.github.io0725-soporte.github.iosoporte2650.github.iosoporte-index09.github.ioapi.sheetbest.comsoporte74.github.iosoporte-c1.github.iosoporteyatencionf.github.iosoporte0725-3.github.iosoporte0625.github.iosoporte-0725.github.iosoporte-index05.github.iosoporte-bn1.github.iosoporte-07-25.github.iosoporte160625.github.iosoporte250324.github.iosoporte2507.github.iosoporter03.github.iosoporte-b2.github.io+16 more

IPv4 (1)

159.89.254.93

Emails (4)

[email protected][email protected][email protected][email protected]

Notes

CONCLUSION GitBait demonstrates how a financially motivated actor can run a large-scale, persistent phishing operation against the Mexican financial sector without owning any traditional attack infrastructure. By hosting cloned banking pages on GitHub Pages, the operator inherits the platform's trusted reputation and default HTTPS coverage, which makes the fraudulent URLs appear legitimate to both victims and automated security tooling. By routing harvested credentials through the SheetBest API into attacker-controlled Google Sheets instead of a dedicated command-and-control server, the actor removes a critical point of exposure and operates entirely within the boundaries of legitimate cloud services. This serverless model significantly reduces the infrastructure footprint, enables rapid redeployment after individual repositories are taken down, and complicates attribution.The operation also reflects a broader shift in the threat landscape: attackers no longer need sophisticated malware or complex infrastructure to conduct credential theft at scale. The abuse of everyday cloud platforms lowers the barrier to entry while increasing operational effectiveness, and the modular kit design, multi-path deployment across more than 100 domains, collaborative operator activity, and periodic rotation of the SheetBest exfiltration endpoint all point to a well-maintained, long-lived campaign rather than a one-off effort. For the financial sector, this means defenses that rely solely on blocklists of known malicious domains will struggle against infrastructure built on reputable services. Effective mitigation requires behavioral detection rather than signature matching alone, continuous monitoring for brand-impersonation activity across hosting platforms such as GitHub Pages, layered customer-side controls including phishing-resistant multi-factor authentication and real-time transaction alerts, and proactive intelligence and indicator sharing with peers, CERTs, and regulators to accelerate coordinated takedown and response.<div> </div>

Mitigation

ATT&CK Mapping <div style="margin-left:0pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col><col><col><col></colgroup><thead><tr style="height:0pt;"><th style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;background-color:#1f3864;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">Tactic</th><th style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;background-color:#1f3864;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">Technique ID</th><th style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;background-color:#1f3864;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">Technique Name</th><th style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;background-color:#1f3864;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">Procedure</th></tr></thead><tbody><tr style="height:0pt;"><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">TA0042 Resource Dev.</td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1583/006/">T1583.006</a></td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">Acquire Infrastructure: Web Services</td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">GitHub Pages repositories and the SheetBest API are abused as hosting and exfiltration infrastructure, removing the need for any dedicated backend server.</td></tr><tr style="height:0pt;"><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">TA0042 Resource Dev.</td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1585/002/">T1585.002</a></td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">Establish Accounts: Email Accounts</td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">Multiple Gmail addresses are registered and tied to operator GitHub accounts used to build and maintain the phishing repositories.</td></tr><tr style="height:0pt;"><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">TA0042 Resource Dev.</td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1587/001/">T1587.001</a></td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">Develop Capabilities: Malware</td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">A modular phishing kit with an internal campaign selector, brand-specific templates, and obfuscated credential-harvesting scripts is developed and reused across targets.</td></tr><tr style="height:0pt;"><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">TA0042 Resource Dev.</td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1608/005/">T1608.005</a></td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">Stage Capabilities: Link Target</td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">Brand-specific phishing pages are staged on GitHub Pages under randomized directory paths to act as link targets delivered to victims.</td></tr><tr style="height:0pt;"><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">TA0001 Initial Access</td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1566/002/">T1566.002</a></td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">Phishing: Spearphishing Link</td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">Fraudulent github.io URLs are delivered to victims via messaging apps and SMS, using crafted Open Graph previews to render trusted brand link cards.</td></tr><tr style="height:0pt;"><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">TA0005 Defense Evasion</td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1656/">T1656</a></td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">Impersonation</td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">Landing and login pages clone the branding, layout, and authentication workflows of at least 12 Mexican financial institutions.</td></tr><tr style="height:0pt;"><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">TA0005 Defense Evasion</td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1027/">T1027</a></td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">Obfuscated Files or Information</td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">Credential-harvesting logic is loaded as externally hosted, heavily obfuscated JavaScript via randomized paths to defeat static analysis and enable payload rotation.</td></tr><tr style="height:0pt;"><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">TA0006 Credential Access</td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1056/003/">T1056.003</a></td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">Input Capture: Web Portal Capture</td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">A client-side script attaches a submit listener and calls e.preventDefault(), capturing usernames, client IDs, passwords, and card data before the legitimate request fires.</td></tr><tr style="height:0pt;"><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">TA0010 Exfiltration</td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1567/">T1567</a></td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">Exfiltration Over Web Service</td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">Captured credentials are serialized to JSON and sent via POST to the SheetBest API, which writes the data directly into attacker-controlled Google Sheets in real time.</td></tr><tr style="height:0pt;"><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">TA0011 C2</td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1102/">T1102</a></td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">Web Service</td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">For one targeted institution, credentials are relayed in real time to a Telegram bot using a hardcoded token and chat ID embedded in the phishing JavaScript.</td></tr><tr style="height:0pt;"><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">TA0040 Impact</td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1657/">T1657</a></td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">Financial Theft</td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:middle;padding:3pt 5.5pt 3pt 5.5pt;overflow:hidden;overflow-wrap:break-word;">Harvested banking credentials and card data enable account takeover, fraudulent transactions, and resale, directly impacting Mexican financial-sector customers. </td></tr></tbody></table></div>