Mispadu Stealer’s New Variant Targets Browser Data of Mexican Users

Unit 42 researchers uncovered a new Mispadu Stealer variant that targets Mexican users by exploiting a Windows SmartScreen bypass (CVE-2023-36025). The malware uses crafted .url shortcut files pointing to a threat actor network share to retrieve payloads without triggering SmartScreen, performs timezone-based geofencing to limit execution to specific regions, and exfiltrates browser data while using encryption to evade detection.