A highly sophisticated phishing operation called GitBait has targeted the Mexican financial sector, employing highly organized and detailed fraud techniques. According to cybersecurity analysts at Group-IB, the campaign exploits the credibility of GitHub Pages to create fake banking portalsthat are almost indistinguishable from the real thing.
Users who end up on these pages are tricked into revealing usernames, passwords, bank card details and other sensitive data, often without realizing they have fallen victim to a cyberattack.
A business that has been operating quietly for more than three years
One of the most worrying aspects of the case is the duration of GitBait's activity. Historical analysis of the infrastructure shows that the campaign has remained active for more than three years, constantly evolving and gradually expanding its list of targets.
See also: FBI dismantles phishing service Outsider Enterprise
Researchers have identified attacks targeting at least 24 financial institutions in Mexico, including both domestic banks and international organizations with a presence in the country. The long-term nature of the operation suggests that an organized group with significant technical capabilities and sufficient resources to maintain and expand its infrastructure is behind it.
How GitHub is turning into a fraud tool
The campaign's success relies heavily on the abuse of GitHub Pages, the free web hosting service of the GitHub platform. Because the service has a strong reputation and uses secure HTTPS connections by default, most security solutions and many users do not treat these pages as suspicious.
Attackers exploit this trust by creating fake banking websites. The fake portals accurately replicate the corporate identity, layout, colors, and navigation structure of real banking services, reinforcing the illusion of legitimacy.
More than 200 domains and modular architecture
Group -IB has linked more than 200 different domains to the GitBait campaign. Each domain contains multiple phishing pages hosted on different directory paths, using names such as “support”, “cancelacion” and “mbw”, which mimic real banking service categories.
This approach makes it significantly more difficult to detect and remove the content. Even if one page is detected and removed, the others will still function normally.
The infrastructure is fully modular, allowing operators to quickly change phishing templates and add new banking institutions to their targets without having to build the platform from scratch.
Data theft without traditional servers
Another element that makes GitBait particularly dangerous is that it operates without a conventional command-and-control server. When a victim enters their details, the page's JavaScript intervenes in the process and collects the data before it is sent to the real website.
See also: UNC1151 launches Gmail phishing campaign to steal 2FA passwords
The information is then converted to JSON format and sent via a POST request to the SheetBest API, which routes the stolen data directly to Google Sheets controlled by the perpetrators.
In some cases, researchers also observed an alternative method of handling stolen information: Victims' details were sent in real time via a bot on Telegram, using credentials embedded directly in the page's JavaScript code.
🔑 Secure your passwords with Proton Pass
Password manager from Proton — end-to-end encryption, passkeys, built-in 2FA, and monitoring for leaks of your credentials.
- ✔ Encrypted storage of passwords & passkeys
- ✔ Notification if any of your passwords are leaked (Dark Web Monitoring)
- ✔ Free version — on all devices
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
The new generation of phishing is more agile and harder to detect
GitBait highlights a broader trend in cybercrime. Modern phishing attacks no longer rely solely on suspicious servers or malicious websites that are easily detected by security tools. Instead, attackers are leveraging legitimate and trusted cloud services, reducing their operating costs and significantly increasing their chances of success.
Experts recommend that financial institutions actively monitor for GitHub repositories that use names similar to their brand names and implement mechanisms to detect suspicious requests to services like SheetBest.
See also: Sniper Dz: INTERPOL dismantles phishing platform – Administrator arrested
At the same time, implementing real-time transaction alerts, analyzing user behavior, and sharing threat intelligence between organizations are now considered essential defense measures against operations like GitBait, which demonstrate that phishing is evolving into an increasingly professional and technologically advanced form of digital crime.
