Astaroth Banking Malware Leveraging GitHub to Host Malware Configurations

Astaroth Banking Trojan Utilizes GitHub for Configuration Hosting

The Astaroth banking trojan has resurfaced, employing a novel method to distribute its malicious configuration files. Initially detected in late 2025, this campaign uses GitHub’s raw content service to host encrypted JSON configurations. These configurations include target URLs, browser injection parameters, and command-and-control (C2) endpoints.

By leveraging GitHub’s trusted domain, Astaroth avoids conventional network-based detection and integrates seamlessly with regular developer traffic. The delivery mechanism remains consistent with previous outbreaks, involving spear-phishing emails containing malicious Word documents with obfuscated macros and decoy content.

Victims report receiving emails purportedly from financial institutions or corporate partners, often citing urgent invoice discrepancies. Opening the attached document activates a Visual Basic for Applications (VBA) macro that downloads a lightweight .NET loader from a remote site.

Upon execution, the loader accesses GitHub’s raw content URLs to retrieve the next-stage configuration, which is decrypted in memory before initiating multiple threads for web injection and credential harvesting. According to McAfee researchers, by using GitHub as a distribution point, the malware bypasses static allow-lists and evades detection by endpoint protection platforms, extending its operational window.

The primary targets are banking customers in Europe and North America, with impacts including unauthorized fund transfers and credential theft across multiple online banking portals. In certain instances, ransomware deployment is used for lateral movement.

Advanced Configuration Management via GitHub

Victims often remain unaware of the infection for weeks due to the malware’s use of process hollowing and parent-child process masquerading, which helps avoid sandbox detection. Minimal files are dropped to disk, and registry entries mimic legitimate Microsoft Office components, complicating forensic analysis for security teams.

The infection mechanism involves a sophisticated multi-stage process designed for stealth and reliability. Upon opening the malicious Word document, the embedded macro executes a sequence that downloads and runs a loader executable. This loader fetches and decrypts the GitHub-hosted configuration, illustrating Astaroth’s reliance on legitimate infrastructure to obscure its malicious intent.

Continuous monitoring of unusual GitHub raw content access from non-developer endpoints is recommended as a key detection strategy.

Based on reporting by Cyber Security News.