Astaroth Trojan abuses GitHub to host configs and evade takedowns

McAfee discovered a new Astaroth campaign that uses GitHub repositories to host malware configurations, allowing attackers to evade takedowns by pulling fresh settings from the platform and staying operational even if C2 servers are shut down. Astaroth primarily targets South American countries including Brazil, Mexico, Uruguay, Argentina, Paraguay, Chile, Bolivia, Peru, Ecuador, Colombia, Venezuela and Panama, with additional hits in Portugal and Italy.

The infection chain begins with phishing emails containing a link to a ZIP file, which drops an LNK that launches obfuscated JavaScript via mshta.exe; the JavaScript then downloads an AutoIt script, an AutoIt interpreter, an encrypted payload, and an encrypted config to ProgramData.

The script builds and runs in-memory shellcode, decrypts and injects the final Astaroth payload into a new RegSvc.exe process, and performs anti-analysis checks while monitoring foreground windows for banking and crypto sites, hooking the keyboard to harvest credentials when those sites are detected. Trend Micro published Indicators of Compromise for this campaign, and the malware uses a Ngrok reverse proxy to transmit stolen data.