Astaroth Banking Trojan Abuses GitHub to Remain Operational After Takedowns

Astaroth, a banking Trojan, is being observed abusing GitHub as a backbone to stay operational after takedowns, with McAfee noting that attackers host malware configurations on GitHub so the Trojan can fetch fresh C2 configurations when primary infrastructure is knocked out. According to McAfee, the campaign is centred on Brazil but also targets a broad set of Latin American countries including Mexico, Uruguay, Argentina, Paraguay, Chile, Bolivia, Peru, Ecuador, Colombia, Venezuela and Panama.

The latest chain begins with a DocuSign-themed phishing email that leads to a zipped Windows shortcut file (.lnk); opening it downloads JavaScript that fetches additional code and modules, eventually loading a Delphi-based DLL to inject Astaroth into a RegSvc.exe process. Astaroth monitors browser windows to detect banking sites and uses keystroke capture to harvest credentials, transmitting them via the Ngrok reverse proxy.

The campaign also includes persistence by placing an LNK in the Startup folder and geofencing the initial URL, while also checking system locale to avoid English-language targets; according to McAfee, the malware uses GitHub to update its configuration when C2 servers are inaccessible, a method that was temporarily neutralised after GitHub repositories were removed with Microsoft’s involvement.