Phishing Marketing campaign Targets Mexican Taxpayers With Tax-Themed Lures

A phishing marketing campaign is concentrating on customers in Mexico with tax-themed lures, in accordance with researchers at Cisco Talos.

The phishing emails direct customers to a web site that makes an attempt to trick them into downloading a brand new pressure of information-stealing malware known as “TimbreStealer.”

“The phishing marketing campaign makes use of geofencing strategies to solely goal customers in Mexico, and any try to contact the payload websites from different areas will return a clean PDF file as a substitute of the malicious file,” the researchers write.

“The present spam run was noticed to primarily use Mexico’s digital tax receipt customary known as CDFI (which stands for ‘Comprobante Fiscal Digital por Web,’ or on-line fiscal digital bill in English). Talos has additionally noticed emails utilizing generic bill themes used for a similar marketing campaign.”

The menace actor behind this operation was answerable for one other marketing campaign utilizing the Mispadu Trojan earlier in 2023.

“Talos has noticed new distribution campaigns being performed by this menace actor since not less than September 2023, once they had been initially distributing a variant of the Mispadu banking trojan utilizing geofenced WebDAV servers earlier than altering the payload to this new information-stealer,” the researchers write. “After the menace actor modified to this new stealer, we haven’t discovered any proof of Mispadu getting used anymore.”

The TimbreStealer malware is refined and seems to be custom-made. As soon as put in, the malware makes an attempt to steal credentials from the sufferer’s machine.

“TimbreStealer reveals a complicated array of strategies to bypass detection, have interaction in stealthy execution, and guarantee its persistence inside compromised programs,” the researchers write. “This consists of leveraging direct system calls to bypass typical API monitoring, using the Heaven’s Gate method to execute 64-bit code inside a 32-bit course of, and using {custom} loaders. These options point out a excessive stage of sophistication, suggesting that the authors are expert and have developed these parts in-house.”

KnowBe4 empowers your workforce to make smarter safety selections every single day. Over 65,000 organizations worldwide belief the KnowBe4 platform to strengthen their safety tradition and cut back human danger.

Cisco Talos has the story.