Yes

>>Cybercriminals are using a malicious program disguised as software on GitHub to steal login details from cryptocurrency users in South America.

Cybercriminals are using a malicious program disguised as software on GitHub to steal login details from cryptocurrency users in South America.

crypthub

1 day ago

New Banking Trojan Emerges

The Astaroth banking Trojan is a growing threat, utilizing phishing emails to distribute malware through Windows files. After installation, it operates stealthily in the background, employing keylogging to steal sensitive banking and cryptocurrency credentials. This stolen data is then transmitted to hackers using the Ngrok reverse proxy.

Unique GitHub Integration

Astaroth distinguishes itself by leveraging GitHub repositories to manage server configurations. This strategy allows the malware to reroute communication when its primary command-and-control servers are disrupted. GitHub is used for configurations, not hosting the malware itself, a tactic observed in past campaigns.

Geographic Targeting and Capabilities

The malware primarily targets users in South American countries like Brazil, Mexico, and Uruguay, while avoiding English-speaking regions. Astaroth includes sophisticated features such as the ability to detect and halt analysis software and target specific banking and cryptocurrency websites. Users are advised to be cautious about unknown links and attachments and to implement robust security measures.