Phishing Campaign Targets Mexican Taxpayers With Tax-Themed Lures

Cisco Talos observed a Mexico-targeted phishing campaign delivering a new information-stealer called "TimbreStealer" via tax/invoice-themed emails and geofenced payload sites; the malware uses advanced techniques (direct syscalls, Heaven's Gate, custom loaders) for stealth and persistence and appears linked to an actor that previously distributed Mispadu.