GitBait phishing campaign targeting Mexican banks
Campaign
Summary
Hide ▲
Show ▼
A long-running GitBait phishing campaign is stealing banking credentials from customers of Mexican financial institutions, using GitHub Pages and SheetBest to hide its infrastructure and complicate takedown. The operation has hit at least 12 institutions over roughly three years and relies on cloned bank pages plus cloud-based data forwarding. Its serverless design reduces seizure opportunities while increasing the risk of credential theft and downstream account abuse.
Related Happenings
GitHub API enumeration campaign targeting corporate organizations
Campaign
H score17
First: 09.07.2026 21:38
Last: 09.07.2026 21:38
Sources 1
About this happening:
A GitHub API reconnaissance campaign is systematically mapping corporate organizations, repositories, and user accounts across multiple companies, expanding the risk of fo...
GitHub API enumeration campaign targeting corporate organizations
CampaignAbout this happening: A GitHub API reconnaissance campaign is systematically mapping corporate organizations, repositories, and user accounts across multiple companies, expanding the risk of fo...
Paid brand-impersonation phishing kits Lucid and Lighthouse scale fake-domain operations
Threat Actor Meta
H score37
First: 01.07.2026 10:20
Last: 01.07.2026 10:20
Sources 1
About this happening:
Brand-impersonation phishing has become a paid service, with kits like Lucid and Lighthouse scaling fake-domain operations across 316 brands in 74 countries, i...
Paid brand-impersonation phishing kits Lucid and Lighthouse scale fake-domain operations
Threat Actor MetaAbout this happening: Brand-impersonation phishing has become a paid service, with kits like Lucid and Lighthouse scaling fake-domain operations across 316 brands in 74 countries, i...
Sniper Dz MENA fake Facebook phishing and monetization campaign
Campaign
H score30
First: 15.06.2026 09:30
Last: 15.06.2026 09:30
Sources 1
About this happening:
A Sniper Dz fraud campaign is targeting users across the Middle East and North Africa with fake Facebook accounts that impersonate politicians, public figures, and tru...
Sniper Dz MENA fake Facebook phishing and monetization campaign
CampaignAbout this happening: A Sniper Dz fraud campaign is targeting users across the Middle East and North Africa with fake Facebook accounts that impersonate politicians, public figures, and tru...
FBI takedown of Outsider Enterprise phishing service
Law Enforcement
H score63
First: 14.06.2026 17:36
Last: 14.06.2026 17:36
Sources 1
About this happening:
The FBI and partners dismantled Outsider Enterprise, a phishing-as-a-service operation tied to thousands of phishing websites and large-scale credential theft....
FBI takedown of Outsider Enterprise phishing service
Law EnforcementAbout this happening: The FBI and partners dismantled Outsider Enterprise, a phishing-as-a-service operation tied to thousands of phishing websites and large-scale credential theft....
NFCShare fake banking-app update phishing campaign
Campaign
H score40
First: 09.06.2026 01:11
Last: 09.06.2026 01:11
Sources 1
About this happening:
The NFCShare phishing campaign is using fake banking-app updates on GitHub to steal payment card data from customers of multiple banks across Europe, expanding...
NFCShare fake banking-app update phishing campaign
CampaignAbout this happening: The NFCShare phishing campaign is using fake banking-app updates on GitHub to steal payment card data from customers of multiple banks across Europe, expanding...
Timeline
-
17.06.2026 17:00 2 articles · 28d ago
GitBait steals banking credentials from Mexican financial institutions
Initial DisclosureGroup-IB identified GitBait as a long-running phishing operation targeting customers of Mexican financial institutions and linked it to at least 12 institutions over roughly three years. The campaign hosted fake bank pages on GitHub Pages, forwarded stolen logins through SheetBest, and used duplicated pages, Open Graph previews, noindex tags, randomized JavaScript paths and GitHub Actions automation to reduce takedown risk.
Show sources
- Serverless Phishing Kit on GitHub Targets Mexican Banks — www.infosecurity-magazine.com — 17.06.2026 17:00
- Serverless Phishing Kit on GitHub Targets Mexican Banks — www.infosecurity-magazine.com — 17.06.2026 17:00