TimbreStealer Malware Spreading via Tax-themed Phishing Scam Targets IT Users

Cisco Talos identified a tax-themed phishing campaign active since at least November 2023 that distributes a new Windows information stealer called TimbreStealer to Mexican users; the campaign uses geofencing, custom loaders, direct syscalls and Heaven's Gate to evade detection and ensure persistence, and the malware harvests credentials, system metadata, browser URLs, and checks for remote desktop software while avoiding Russian locales and sandboxes.