Banking malware used GitHub for persistence

GitHub has removed malicious code repositories that acted as command and control (C2) infrastructure for a banking information stealer, after being notified by McAfee security researchers.

The Astaroth trojan horse is spread by phishing, and if executed via a Windows shortcut, installs malware on the victim's system, McAfee said.

Able to detect when users access banking and cryptocurrency websites, Astaroth then copies login credentials for these and sends them to the attackers via the Ngrok reverse proxy tool.

McAfee’s Threat Research team uncovers a new Astaroth campaign leveraging GitHub to host malware configurations. Infection starts with a phishing link that downloads a zipped LNK. When executed, it installs Astaroth. https://t.co/JknUDPnubl pic.twitter.com/yEdCAJGDjT

— Virus Bulletin (@virusbtn) October 13, 2025

Even though the C2 servers that the Ngrok tool connected were taken down, Astaroth was able to connect to GitHub to pull fresh configurations from the site, and stay running.

"Think of it like a criminal who keeps backup keys to your house hidden around the neighbourhood. Even if you change your locks, they’ve got another way in," McAfee's researchers wrote.

Astaroth targets mainly users located in South America, particularly Brazil, but can also be used against Italy and Portugal.

It has been active for several years now: Microsoft's Defender Security Research Team analysed Astaroth in 2019, detailing its file-less capabilities.

The malware is also known as Guildma, and was documented by Cisco's Talos researchers in 2024, as using the Google Cloud Run service for large scale distribution.

GitHub has also been used for malware distribution in the past, with Microsoft Security unravelling a convoluted redirection chain leading users to the code repository in March this year.

The multi-stage payload hosted on GitHub was infostealers such as Lumma and Doenerium, Microsoft Security found.