Astaroth Malware Uses Steganography in GitHub Images for Covert C2 Backup and Brazilian Bank Theft

The McAfee Threat Research team has uncovered a new Astaroth malware campaign that uses GitHub repositories as backup command-and-control servers, allowing the information-stealing malware to stay operational even when its main infrastructure is disrupted.

According to McAfee researchers, “Instead of relying solely on traditional C2 servers that can be taken down, these attackers are leveraging GitHub repositories to host malware configurations,” and when defenders dismantle a server, Astaroth “simply pulls fresh configurations from GitHub and keeps running.” The infection starts with a phishing email linking to a ZIP archive containing a malicious Windows shortcut, which launches obfuscated JavaScript via mshta.exe to download additional components.

The malware targets South American financial institutions such as caixa.gov[.]br and itau.com[.]br, and extends to cryptocurrency platforms like Binance and MetaMask. A notable feature is the use of GitHub to update its configuration by embedding data in images through steganography, enabling parameter refresh every two hours, and it communicates with C2 servers through Ngrok reverse proxies to exfiltrate data.