Security firm McAfee reports the Astaroth banking trojan might be using GitHub to change server locations, potentially compromising Bitcoin login details.

Astaroth Keylogger Overview

Astaroth keylogger functions as a banking Trojan. It employs GitHub-hosted configuration files for a specific operational purpose.

Redirection Capabilities

The keylogger redirects infected systems to alternative command-and-control servers when its primary servers are disabled.

Continued Operation

This redirection mechanism allows for the persistence of credential theft even after the original infrastructure is compromised.