Cybersecurity experts have identified a new group of information thieves called TimbreStealer, which uses phishing emails under pretexts such as invoices and digital tax receipts. In Unotv.com we explain how this malware targets Mexican taxpayers.<\/p>\n
The TimbreStealer campaign uses phishing emails with themes related to Mexican taxes.
\nWith this \u201cbait,\u201d they direct users to a compromised website where the malware is hosted and trick them into running the malicious application, according to cybersecurity firm
\n\u201cIt has been observed that the current spam mainly uses Mexico's digital tax receipt standard called CFDI (comprobante fiscal digital por internet). Emails with generic invoice themes used for the same campaign have also been detected.\u201d.<\/p>\n
Digital tax receipts are the lure for this phishing email campaign, that is, a technique that consists of sending emails -or SMS- that impersonate the identity of companies or public bodies and request personal and banking information from the user \u201cIn this one, a spam email was used as a lure to redirect users to a malicious web page hosted on compromised sites,\u201d according to cybersecurity workers.<\/p>\n
The email subjects in the TimbreStealer campaign consistently contain the same subject line:
\nThe website detects user characteristics such as the type of browser used, and then initiates the download of a Zip file containing the .url file, which in turn will download the initial TimbreStealer malware.<\/p>\n
User interaction is required to open the downloaded Zip file and double-click on the .url file for the malware to execute, at which point the main TimbreStealer infection will start.<\/p>\n
The phishing campaign uses geofencing techniques to target only users in Mexico from at least November 2023, according to IT experts.<\/p>\n
Any attempt to contact the payload sites from locations other than Mexico will return a blank PDF file instead of the malicious file, they say.
\nWhat information can be stolen from you?<\/p>\n
The TimbreStealer malware can collect a wide variety of information from the victim's machine and post data on an external website. This is the information that the attacking group can steal:<\/p>\n
Expertos de ciberseguridad identificaron un nuevo grupo de ladrones de informaci\u00f3n llamado TimbreStealer, el cual utiliza correos de phishing con pretextos como facturas y comprobantes fiscales digitales. En Unotv.com te explicamos c\u00f3mo funciona este malware dirigido a contribuyentes mexicanos. Alertan por comprobantes fiscales falsos para robar informaci\u00f3n La campa\u00f1a de TimbreStealer utiliza correos electr\u00f3nicos de […]<\/p>\n","protected":false},"author":1,"featured_media":4477,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[39],"tags":[],"class_list":["post-4476","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-digital"],"acf":[],"yoast_head":"\n