A phishing campaign is targeting users in Mexico with tax-themed lures, according to researchers at Cisco Talos.
The phishing emails direct users to a website that attempts to trick them into downloading a new strain of information-stealing malware called “TimbreStealer.”
“The phishing campaign uses geofencing techniques to only target users in Mexico, and any attempt to contact the payload sites from other locations will return a blank PDF file instead of the malicious file,” the researchers write.
“The current spam run was observed to mainly use Mexico's digital tax receipt standard called CDFI (which stands for ‘Comprobante Fiscal Digital por Internet,’ or online fiscal digital invoice in English). Talos has also observed emails using generic invoice themes used for the same campaign.”
The threat actor behind this operation was responsible for another campaign using the Mispadu Trojan earlier in 2023.
“Talos has observed new distribution campaigns being conducted by this threat actor since at least September 2023, when they were initially distributing a variant of the Mispadu banking trojan using geofenced WebDAV servers before changing the payload to this new information-stealer,” the researchers write. “After the threat actor changed to this new stealer, we haven’t found any evidence of Mispadu being used anymore.”
The TimbreStealer malware is sophisticated and appears to be custom-made. Once installed, the malware attempts to steal credentials from the victim’s machine.
“TimbreStealer exhibits a sophisticated array of techniques to circumvent detection, engage in stealthy execution, and ensure its persistence within compromised systems,” the researchers write. “This includes leveraging direct system calls to bypass conventional API monitoring, employing the Heaven’s Gate technique to execute 64-bit code within a 32-bit process, and utilizing custom loaders. These features indicate a high level of sophistication, suggesting that the authors are skilled and have developed these components in-house.”
KnowBe4 empowers your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
Cisco Talos has the story.
