Hackers Abuse SheetBest API to Exfiltrate Banking Credentials Into Google Sheets

Researchers uncovered a multi-year, financially motivated phishing campaign targeting at least 12 Mexican financial institutions that uses a fully serverless architecture hosted across many GitHub Pages repositories. The operation leverages modular phishing templates, obfuscated external JavaScript and the SheetBest API to exfiltrate credentials directly into attacker-controlled Google Sheets, uses social messaging-friendly Open Graph metadata to improve click-through rates, and employs distributed hosting and randomized paths for persistence and takedown resistance; multiple defanged domain indicators are provided.