Hackers Abuse EdgeUpdate and GoogleUpdater to Deploy TimbreStealer Infostealer

A Mexico-focused phishing campaign distributes the TimbreStealer infostealer by shipping malicious DLLs named like legitimate updater libraries inside ZIPs hosted on cloud-provider IPs and abusing DLL side-loading of msedgeupdate/goopdate. The malware uses custom API resolution, RC4-based decryptors, large zero-entropy PE sections, geofencing (locale/timezone/desktop checks) and anti-analysis techniques, and it exfiltrates browser and mail artifacts (Chrome/Edge/Firefox/Thunderbird), making this a technically advanced and high-risk threat for targeted organizations.