GitBait Phishing Campaign Abuses GitHub Pages to Attack Financial Institutions

Cybersecuritynews •Tushar Subhra Dutta • June 17, 2026

A sophisticated phishing campaign called “GitBait” has been caught targeting Mexico’s financial sector with a level of precision rarely seen in credential-theft operations. The campaign abuses GitHub Pages, a widely trusted free hosting service, to deliver fake banking portals that look nearly identical to the real thing. Victims who land on these pages are tricked […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

GitBait Phishing Campaign Targets Mexican Banks via GitHub Pages A modular phishing operation named GitBait has been uncovered, targeting at least 12 Mexican financial institutions over three years. This campaign utilizes GitHub Pages to host fake banking websites, employing a serverless architecture that leverages the SheetBest API for credential exfiltration. The phishing kit allows attackers to generate institution-specific pages, capturing sensitive information such as usernames, passwords, and payment card details. Group-IB reported over 100 GitHub-hosted domains associated with this operation, which has shown long-term persistence and continuous development. Victims are likely lured through direct messages on platforms like WhatsApp and Telegram, with the phishing pages designed to mimic legitimate bank branding. The campaign highlights a trend where cybercriminals exploit trusted cloud services instead of traditional server infrastructures. 4 sources 68

Extracted Entities

GitBait Phishing Campaign Abuses GitHub Pages to Attack Financial Institutions

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Countries (1)

Industries (1)

MITRE ATT&CK (1)

Tools (1)