New Infostealer Trojan uses Fiddler Proxy & Json.NET

**Executive Summary:** Zscaler ThreatLabZ discovered a .NET-based Infostealer Trojan (installer named with double-extension like curp.pdf.exe) actively targeting Banamex customers in Mexico and capable of updating its C2 configuration to add further financial targets; the malware deploys FiddlerCore and Json.NET to intercept HTTP/HTTPS traffic, perform domain-to-IP hijacking to serve phishing sites, and periodically refreshes C2 lists every 10 minutes. The report includes technical behavior, persistence differences by OS version, sample C2/config format, and multiple MD5 IOCs.