Threat actors abuse GitHub service to host a variety of phishing kits

guest · Apr 24, 2019

Threat actors abuse GitHub service to host a variety of phishing kits
April 24, 2019
https://www.proofpoint.com/us/threa...use-github-service-host-variety-phishing-kits

Since at least mid-2017, phishers have also been abusing free code repositories on the popular GitHub service to host phishing websites on the canonical $github_username.github.io domain.
These repositories have been used for a range of malicious activities, including the phishing email campaign shown in Figure 1 abusing a retail bank brand:

Sending stolen credentials to another compromised website appears to be commonplace for all the active phishing kits we have observed on github.io. Moreover, it appears that the kits do not use typical hosted PHP methods because the github.io platform does not provide PHP back-end services.
Conclusion
While the GitHub service itself appears to be responsive and especially vigilant in taking down abusive accounts hosting this type of material, defenders should be aware of potential malicious content on $github_username.github.io canonical domains.
Click to expand...

Log in or Sign up

Threat actors abuse GitHub service to host a variety of phishing kits

guest Guest

Log in or Sign up

Threat actors abuse GitHub service to host a variety of phishing kits

guest Guest

Useful Searches