Serverless Phishing Kit on GitHub Targets Mexican Banks

Group-IB analyzed the "GitBait" phishing operation that stole banking credentials from customers of at least 12 Mexican banks over ~3 years by hosting cloned bank pages on GitHub Pages and sending captured logins to Google Sheets via SheetBest; the modular kit, automated deployments, obfuscated payload hosting, and domain rotation let operators maintain and rapidly redeploy pages while evading traditional blocklists.