Modular Phishing Kit Uses GitHub Pages to Steal Payment Card Details and Passwords

Gbhackers •Mayura Kathir • June 17, 2026

A sophisticated, long-running phishing operation has evolved into a serverless, modular campaign that weaponizes GitHub Pages to harvest payment card data, credentials, and customer identifiers from banking customers in Mexico. The campaign’s architecture centers on a phishing kit containing a selector panel that operators use to generate institution-specific landing pages. Those landing pages impersonate at […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

GitBait Phishing Campaign Targets Mexican Banks via GitHub Pages A modular phishing operation named GitBait has been uncovered, targeting at least 12 Mexican financial institutions over three years. This campaign utilizes GitHub Pages to host fake banking websites, employing a serverless architecture that leverages the SheetBest API for credential exfiltration. The phishing kit allows attackers to generate institution-specific pages, capturing sensitive information such as usernames, passwords, and payment card details. Group-IB reported over 100 GitHub-hosted domains associated with this operation, which has shown long-term persistence and continuous development. Victims are likely lured through direct messages on platforms like WhatsApp and Telegram, with the phishing pages designed to mimic legitimate bank branding. The campaign highlights a trend where cybercriminals exploit trusted cloud services instead of traditional server infrastructures. 4 sources 68

Extracted Entities

Modular Phishing Kit Uses GitHub Pages to Steal Payment Card Details and Passwords

The full story

Extracted Entities

Attack Types (1)

Countries (1)

MITRE ATT&CK (1)

Tools (1)