TimbreStealer Malware Campaign Targets Mexican Companies with Advanced Evasion Techniques

A new campaign linked to the TimbreStealer malware targets companies in Mexico, employing advanced evasion techniques. Researchers Euler Neto and Cristóbal Tárraga report that the malware uses DLL side-loading with malicious DLLs sized between 45 and 50 MB, masquerading as legitimate updater files. The initial attack vector is phishing emails delivering ZIP files hosted on DigitalOcean IPs, with filenames referencing Mexican fiscal documents to increase click rates. The malware contains heavy anti-analysis measures, including 27 sections with zeroed content and custom API resolution to avoid detection. It performs extensive data collection from browsers and user data stores, particularly targeting Google Chrome and Microsoft Edge. The campaign echoes tactics observed in a 2024 Cisco Talos report, indicating a sophisticated approach to evade detection. Current status indicates ongoing threats to Mexican companies.

Key Points: • TimbreStealer malware targets Mexican companies using advanced evasion techniques. • Phishing emails deliver ZIP files containing malicious DLLs masquerading as legitimate updaters. • The malware employs heavy anti-analysis measures and collects sensitive user data.