Astaroth Banking Trojan Exploits GitHub to Target Crypto Credentials

McAfee researchers have identified a sophisticated banking Trojan campaign leveraging GitHub repositories as a fallback mechanism. Dubbed Astaroth, the malware maintains operational resilience by redirecting to new servers through GitHub when existing command-and-control infrastructure gets shut down.

The Trojan primarily targets South American users, with Brazil appearing as a key focus. Attack vectors involve phishing emails distributing malicious Windows shortcut (.lnk) files. Once installed, Astaroth operates stealthily in the background, employing keylogging techniques to harvest sensitive banking and cryptocurrency credentials.

Unlike conventional malware, Astaroth doesn't host payloads on GitHub. Instead, it uses the platform to dynamically update server configurations when cybersecurity teams disrupt its operations. "GitHub serves merely as a configuration repository pointing to active bot servers," explains Abhishek Karnik, McAfee's Director of Threat Research.