Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
4 IOCs
Hackers Abuse SheetBest API to Exfiltrate Banking Credentials Into Google Sheets
Excerpt
GitHub is a trusted platform for millions of developers, but financially motivated threat actors are increasingly weaponizing its infrastructure. In a sophisticated new campaign, researchers have uncovered a massive phishing operation targeting at least 12 financial institutions in Mexico. Active for approximately 3 years, this campaign stands out for its fully serverless architecture. Attackers are successfully abusing GitHub Pages for hosting and the SheetBest API for…
Read the original report →Diamond Model
Adversary
Infrastructure(4)
Capability
Victim
Attack Flow7 steps · MITRE ATT&CK mapped
Indicators of Compromise
Open the mindmap →4 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | sntdr-soporte25.github.io | High | Score 58/100 | First seen |
| Domain | soporte-index09.github.io | High | Score 58/100 | First seen |
| Domain | 07-soporte.github.io | High | Score 58/100 | First seen |
| Domain | soporte-index25.github.io | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…