Full Report
Se ha descubierto una infraestructura de phishing modular dirigida a múltiples bancos mexicanos, que abusa de GitHub Pages, emplea scripts ofuscados y centraliza la exfiltración de credenciales mediante la API de SheetBest, lo que indica una operación de phishing escalable y persistente de múltiples marcas.
Analysis Summary
# Tool/Technique: Modular Mexican Banking Phishing Infrastructure
## Overview
This is a sophisticated, modular phishing infrastructure specifically designed to target customers of multiple Mexican financial institutions. The operation leverages legitimate cloud services and development platforms to host deceptive content, bypass traditional security filters, and centralize the collection of stolen credentials. The campaign is notable for its scalability and its use of the "SheetBest" API to transform Google Sheets into a backend database for exfiltrated data.
## Technical Details
- **Type:** Phishing Infrastructure / Attack Framework
- **Platform:** Web-based (Targeting Mobile and Desktop users via browsers)
- **Capabilities:** Credential harvesting, multi-brand targeting, automated data centralisation, code obfuscation, and abuse of legitimate SaaS platforms (GitHub, SheetBest).
- **First Seen:** Approximately May 2024 (based on domain registration patterns like `soporte0525`).
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link]
- **[TA0002 - Execution]**
- [T1204.001 - User Execution: Malicious Link]
- **[TA0005 - Defense Evasion]**
- [T1027 - Obfuscated Files or Information]
- [T1567.001 - Impair Defenses: Abuse of Trusted Cloud Services]
- **[TA0010 - Exfiltration]**
- [T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage]
## Functionality
### Core Capabilities
- **Modular Hosting:** Utilizes GitHub Pages (`github.io`) to host phishing landing pages, benefiting from the platform's high reputation to evade URL filters.
- **Credential Harvesting:** Specifically designed forms to capture banking usernames, passwords, and sensitive PII (Personally Identifiable Information).
- **Automated Exfiltration:** Uses the **SheetBest API** to send captured data directly to attacker-controlled Google Sheets, eliminating the need for a custom C2 server.
### Advanced Features
- **Script Obfuscation:** Employs obfuscated JavaScript to hide the logic of data exfiltration and prevent automated analysis of the phishing kit.
- **Dynamic Brand Targeting:** The infrastructure is designed to be easily replicated across different banking brands (Santander, Banamex, etc.) by swapping visual assets while maintaining the same backend logic.
- **Cloud-Native Persistence:** By abusing GitHub and Google Sheets, the attackers ensure high availability and low operational costs.
## Indicators of Compromise
### Network Indicators (Defanged)
- **GitHub Pages Subdomains:**
- `fldsmdfr-94[.]github[.]io`
- `soporteyatencionf[.]github[.]io`
- `sntndr25-soporte[.]github[.]io`
- `sntndr-soporte0825[.]github[.]io`
- `0725soporte[.]github[.]io`
- `soporte-07-25[.]github[.]io`
- `0825-soporte[.]github[.]io`
- `soporte-index05[.]github[.]io`
- `soporte0725-3[.]github[.]io`
- `soporte200525[.]github[.]io`
- `support-vh[.]github[.]io`
- **Exfiltration Points:**
- `sheetbest[.]com/api/blasts/` (Associated API endpoints)
### Behavioral Indicators
- Unusual outbound traffic from browser sessions to `sheetbest.com` during banking login processes.
- Redirection to `github.io` domains when clicking links supposedly originating from official Mexican banking communication channels (SMS/Email).
## Associated Threat Actors
- **Unknown:** The actors appear to be Spanish-speaking or focused specifically on the Mexican financial sector (LATAM-focused cybercriminals).
## Detection Methods
- **Behavioral Detection:** Monitor for HTTP POST requests directed toward `sheetbest.com` or similar API-based spreadsheet services from corporate environments.
- **Network Monitoring:** Alert on high volumes of traffic to newly created or randomly named `github.io` subdomains containing keywords like "soporte," "atencion," or "banca."
- **Content Analysis:** Scan for obfuscated JavaScript patterns commonly used in phishing kits (e.g., heavy use of `eval()`, `String.fromCharCode`, or Base64 encoding in the frontend).
## Mitigation Strategies
- **User Training:** Educate customers and employees that legitimate banks will never host login portals on `github.io` or other free hosting providers.
- **Domain Blocking:** Implement proactive blocking of `*.github.io` subdomains in enterprise proxy/DNS filters if not required for business operations.
- **MFA Implementation:** Encourage the use of hardware-based MFA or app-based TOTP, which are more resilient to basic credential harvesting than SMS-based codes.
- **API Monitoring:** Security teams should monitor for the abuse of "Low-Code/No-Code" platforms (like SheetBest) within their network traffic.
## Related Tools/Techniques
- **Phishing-as-a-Service (PhaaS):** The modular nature suggests a kit that may be sold or distributed among multiple affiliates.
- **Living off Trusted Sites (LOTS):** Similar to "Living off the Land," but leveraging trusted web domains (GitHub, Google, Microsoft) for hosting and exfiltration.