Timbre Stealer campaign targets Mexican users with financial lures
Summary: Cisco Talos observed an ongoing phishing campaign targeting users in Mexico with financial-themed lures, including Mexico's CDFI digital tax receipt standard, that directs victims to a compromised website hosting a new information stealer named TimbreStealer, active since at least November 2023. The malware uses direct system calls, the Heaven's Gate technique to run 64-bit code in a 32-bit process, custom loaders, and a global decryption key that falls out of sync if execution deviates from the expected path, and it geofences to Mexico by returning a blank PDF to other locations.
Bottom line: The campaign follows the same actor's earlier Mispadu banking trojan distribution, and Talos found no evidence of Mispadu once TimbreStealer appeared, so a single actor has swapped payloads while keeping its Mexico-focused delivery intact. The global decryption key that desynchronizes on any shortcut means defenders cannot statically extract the payload and must locate and circumvent every anti-analysis check.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026