GitHub threat report

GitBait, a long-running serverless phishing campaign, has abused GitHub Pages to host fake banking pages targeting at least 12 Mexican financial institutions over roughly three years. Researchers identified over 100 GitHub-hosted domains involved, with attackers using a modular phishing kit and SheetBest to funnel stolen credentials while relying on GitHub's trusted infrastructure to evade blocklists. GitHub has been notified of all identified domains.

• Serverless Phishing Kit on GitHub Targets Mexican Banks - Infose(opens in a new tab)