Astaroth Trojan Abuses GitHub for Resilient C2 Attacks
A new Astaroth banking trojan campaign is using GitHub as a resilient backbone for its operations. Instead of relying on traditional command-and-control (C2) servers that can be shut down, the malware hosts its configurations within image files on the platform using steganography. The attack begins with phishing emails that trick users into downloading a malicious shortcut file, which installs the malware. Astaroth then monitors for visits to banking and cryptocurrency websites, using keylogging to steal credentials. This innovative use of a legitimate service makes the malware's infrastructure significantly harder to disrupt.
Latest mentioned: 10-13
Earliest mentioned: 10-10