Full Report
A modular phishing infrastructure targeting multiple Mexican banks has been uncovered, abusing GitHub-hosted Pages, employing obfuscated scripts, and featuring a centralized credential exfiltration via SheetBest API, indicating a scalable and persistent multi-brand phishing operation.
Analysis Summary
# Incident Report: Scalable Multi-Brand Phishing Campaign Targeting Mexican Banks
## Executive Summary
A modular phishing infrastructure was identified targeting multiple Mexican financial institutions by abusing legitimate cloud services, specifically GitHub-hosted Pages and the SheetBest API. The operation utilized obfuscated scripts and a centralized data exfiltration method to capture and automate the theft of banking credentials. The campaign highlights a shift toward scalable, low-cost "Phishing-as-a-Service" styles of infrastructure to bypass traditional domain reputation filters.
## Incident Details
- **Discovery Date:** July 2024 (Analysis period)
- **Incident Date:** Active throughout 2024
- **Affected Organization:** Customers of various Mexican Banks (e.g., Santander, Citibanamex, etc.)
- **Sector:** Financial Services
- **Geography:** Mexico
## Timeline of Events
### Initial Access
- **Date/Time:** Ongoing
- **Vector:** Likely SMS (Smishing) or Email Phishing.
- **Details:** Attackers directed users to custom subdomains hosted on `github.io`.
### Lateral Movement
- **N/A:** As this was an external phishing campaign, lateral movement within a corporate network was not the primary objective; rather, the focus was on moving from initial contact to credential exfiltration across multiple bank brands.
### Data Exfiltration/Impact
- **Details:** Sensitive user data, including usernames, passwords, and potentially 2-FA tokens, were exfiltrated via the SheetBest API directly into attacker-controlled Google Sheets.
### Detection & Response
- **How discovered:** Identified through Group-IB's Digital Risk Protection monitoring of GitHub-hosted phishing repositories.
- **Response actions:** Reporting of malicious repositories to GitHub for takedown; blacklisting of identified IOCs.
## Attack Methodology
- **Initial Access:** GitHub Pages (`*.github.io`) used to host deceptive login interfaces.
- **Persistence:** High availability through the creation of numerous modular GitHub repositories (e.g., `soporte-b1`, `soporte-c1`).
- **Privilege Escalation:** N/A (Focused on consumer credential theft).
- **Defense Evasion:** Use of obfuscated JavaScript to hide malicious intent from automated scanners and the use of legitimate domains (GitHub) to bypass URL filters.
- **Credential Access:** Web-based phishing forms mimicking legitimate banking portals.
- **Discovery:** Modular design allowed attackers to quickly pivot between different bank brands using the same underlying code.
- **Lateral Movement:** N/A.
- **Collection:** Automated collection of form data via JavaScript.
- **Exfiltration:** Use of **SheetBest API** to send stolen credentials to Google Sheets, avoiding the need for a dedicated backend C2 server.
- **Impact:** Financial fraud and unauthorized account access for bank customers.
## Impact Assessment
- **Financial:** High potential for direct financial loss to affected bank customers.
- **Data Breach:** High; theft of PII and banking credentials.
- **Operational:** Minimal for the banks themselves, but requires significant customer support resources to remediate compromised accounts.
- **Reputational:** Moderate; erosion of trust in digital banking channels.
## Indicators of Compromise
### Network Indicators
- `soporte-index.github[.]io`
- `soporte-c1.github[.]io`
- `soporte-b4.github[.]io`
- `sntndr25-soporte.github[.]io`
- `sntndr-soporte0825.github[.]io`
- `0825-soporte.github[.]io`
- `soporte250324.github[.]io`
- `soporter03.github[.]io`
- `soporte-y-atencion.github[.]io`
- `respaldo94.github[.]io`
- `support-vh.github[.]io`
### Behavioral Indicators
- Scripts making outbound POST requests to `api.sheetbest[.]com`.
- HTML pages utilizing heavy JavaScript obfuscation (e.g., packed or hex-encoded strings) hosted on GitHub Pages.
## Response Actions
- **Containment:** Coordinated with GitHub to disable the identified `github.io` subdomains.
- **Eradication:** Flagged the SheetBest API keys associated with the campaign to disrupt the exfiltration channel.
- **Recovery:** Banks notified to reset credentials for identified compromised users.
## Lessons Learned
- **Cloud Abuse:** Threat actors are increasingly moving away from dedicated VPS hosting toward legitimate SaaS/PaaS platforms (GitHub, Google Sheets) to blend in with normal traffic.
- **Automation:** The use of APIs like SheetBest allows low-skill actors to maintain sophisticated backend databases for stolen data without managing a server.
## Recommendations
- **For Organizations:** Implement Threat Intelligence feeds that specifically monitor for brand keywords on common hosting platforms like GitHub, Netlify, and Vercel.
- **For Consumers:** Enable Multi-Factor Authentication (MFA) that does not rely solely on SMS, and always verify the URL in the browser address bar before entering credentials.
- **For Security Teams:** Implement blocks on known phishing-related API services (like SheetBest) if they are not required for legitimate business operations.