Astaroth Banking Malware Exploits GitHub for Hosting Configuration Files

Astaroth Banking Malware exploits GitHub for hosting configuration files, with McAfee researchers identifying that the latest variant abandons traditional C2 server dependencies in favour of GitHub repositories to maintain operation. The campaign uses steganography to conceal configuration data inside seemingly innocuous image files hosted on GitHub, enabling the malware to fetch disguised configuration files every two hours and keep persistence even when primary infrastructure is disrupted.

Infection begins with carefully crafted phishing emails—themes include DocuSign notifications and resume documents—with links that download compressed Windows shortcut files (.lnk) which run obfuscated JavaScript via mshta.exe. Once installed, Astaroth monitors for banking and cryptocurrency-related browser windows and implements keylogging to capture credentials from sites such as caixa.gov[.]br, safra.com[.]br, itau.com[.]br, and platforms like binance[.]com and metamask[.]io.

The stolen data is transmitted using Ngrok, and persistence is achieved through LNK files placed in system startup folders. The technique highlights a cat-and-mouse dynamic as researchers and GitHub’s security team remove repositories, while new ones can be created to restore operations.