GitBait Phishing Campaign Abuses GitHub Pages to Attack Financial Institutions

GitBait is a sophisticated, multi-year phishing campaign targeting Mexico's financial sector by hosting near-identical bank portals on GitHub Pages to harvest credentials and payment data; stolen data is exfiltrated in real time via the SheetBest API into attacker-controlled Google Sheets and, in some cases, to Telegram. The report enumerates over 200 associated GitHub Pages domains, operator accounts, an API endpoint and IP address used for exfiltration, and recommends proactive monitoring, behavioral detection, transaction alerts, and intelligence sharing.