This threat involves a sophisticated phishing infrastructure named GitBait that targets Mexican financial institutions. It leverages serverless hosting on GitHub Pages and the SheetBest API for credential exfiltration, avoiding the need for dedicated backend servers. Attackers use obfuscated JavaScript, randomized paths, and dynamic brand selection panels to convincingly impersonate legitimate banking portals. The campaign operates over 100 domains, each hosting multiple phishing pages, and collects credentials via multi-stage forms that mimic real banking authentication processes. Stolen credentials are exfiltrated in real-time to attacker-controlled Google Sheets, with an alternative exfiltration channel via a Telegram bot. The operation has persisted for at least three years, maintained by multiple operator accounts through continuous commits and updates.

The campaign enables attackers to harvest credentials from customers of targeted Mexican financial institutions, potentially leading to unauthorized access to banking accounts and financial fraud. The use of legitimate hosting (GitHub Pages) and real-time exfiltration to Google Sheets complicates detection and takedown efforts. The persistence and modularity of the infrastructure increase the operational resilience of the phishing campaign.

No official patch or fix applies as this is a phishing campaign rather than a software vulnerability. Defenders should focus on user awareness training to recognize phishing attempts, implement multi-factor authentication to reduce the impact of credential theft, and monitor for suspicious domains and URLs related to this campaign. Blocking known phishing domains and URLs identified in threat intelligence feeds can help reduce exposure. Since the campaign abuses GitHub Pages and SheetBest API, monitoring for abuse of these services may assist in early detection. There is no vendor patch; mitigation relies on detection and user protection measures.