Phishing Campaign Targets Mexican Taxpayers With Tax-Themed Lures
A phishing campaign is targeting users in Mexico with tax-themed lures, according to researchers at Cisco Talos.
The phishing emails direct users to a website that attempts to trick them into downloading a new strain of information-stealing malware called “TimbreStealer.”
“The phishing campaign uses geofencing techniques to only target users in Mexico, and any attempt to contact the payload sites from other locations will return a blank PDF file instead of the malicious file,” the researchers write.
“The current spam run was observed to mainly use Mexico’s digital tax receipt standard called CDFI (which stands for ‘Comprobante Fiscal Digital por Internet,’ or online fiscal digital invoice in English). Talos has also observed emails using generic invoice themes used for the same campaign.”
The threat actor behind this operation was responsible for another campaign using the Mispadu Trojan earlier in 2023.
“Talos has observed new distribution campaigns being conducted by this threat actor since at least September 2023, when they were initially distributing a variant of the Mispadu banking trojan using geofenced WebDAV servers before changing the payload to this new information-stealer,” the researchers write. “After the threat actor changed to this new stealer, we haven’t found any evidence of Mispadu being used anymore.”
The TimbreStealer malware is sophisticated and appears to be custom-made. Once installed, the malware attempts to steal credentials from the victim’s machine.
“TimbreStealer exhibits a sophisticated array of techniques to circumvent detection, engage in stealthy execution, and ensure its persistence within compromised systems,” the researchers write. “This includes leveraging direct system calls to bypass conventional API monitoring, employing the Heaven’s Gate technique to execute 64-bit code within a 32-bit process, and utilizing custom loaders. These features indicate a high level of sophistication, suggesting that the authors are skilled and have developed these components in-house.”
KnowBe4 empowers your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
Cisco Talos has the story.
Free Phishing Security Test
Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.
Here’s how it works:
- Immediately start your test for up to 100 users (no need to talk to anyone)
- Select from 20+ languages and customize the phishing test template based on your environment
- Choose the landing page your users see after they click
- Show users which red flags they missed, or a 404 page
- Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
- See how your organization compares to others in your industry
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/phishing-security-test-partner?partnerid=001a000001lWEoJAAW