GitBait: Phishing the Mexican Financial Sector

Group-IB documents a multi-year, large-scale phishing campaign targeting at least 12 financial institutions in Mexico that hosts modular, brand-specific phishing pages on many GitHub Pages repositories and exfiltrates credentials serverlessly via SheetBest APIs (and occasionally via a Telegram bot). The report details the kit's multi-stage flow, obfuscated external JavaScript, standardized form structures and IOCs (100+ domains, SheetBest endpoints, IP 159.89.254.93), operator commit history, distribution via messaging app link previews, and provides defensive recommendations for detection, takedown, and customer protection.