The campaign marks a technical step-up for a malware family first tracked in late 2023, when attackers used fiscal and invoice lures to push an obfuscated stealer at users in Mexico. The latest activity keeps the same localised bait but changes parts of the delivery chain, making the infection appear more like routine software activity while hiding the malicious code behind legitimate-looking updater files.
The phishing messages are built around Mexico’s electronic invoicing system, known as Comprobante Fiscal Digital por Internet, or CFDI. File names such as CONTENIDO, COMPROBANTES and CFDI are used to make the messages look like tax or accounting material. Victims are directed to ZIP archives hosted on cloud infrastructure, including direct IP-based links, rather than obvious malicious domains.
Inside the archives, attackers place executable files resembling Microsoft Edge or Google updater components alongside malicious dynamic-link libraries named msedgeupdate. dll or goopdate. dll. This method, known as DLL side-loading, abuses the way legitimate programmes load nearby libraries. When the trusted-looking executable runs, it loads the attacker-controlled DLL, giving the malware a path into the system while blending into normal software behaviour.
The DLLs stand out because of their size. Malicious samples have been observed at around 45MB to 50MB, far larger than normal updater DLLs, which are usually below 500KB. That unusual size is not accidental. The malware contains multiple sections, many of them filled with low-entropy or zeroed data, which are later used to build content during execution. This helps frustrate static scanning tools that examine a file before it runs.
The stealer also uses custom API resolution, parsing internal Windows structures rather than relying on ordinary import tables that security tools can easily inspect. Strings and execution components are decrypted in stages. Analysts have identified RC4-based routines that reveal references to “Zw” and “ntdll. dll”, pointing to the use of lower-level Windows calls to reduce visibility to endpoint monitoring systems.
The malware’s payload is deliberately obscured. One stage decrypts a PE-like file whose identifying header bytes have been damaged, making it harder for automated tools to recognise it as a Windows executable. Execution appears to depend on ordered runtime checks and mutable decryption keys. If those checks do not occur in the expected sequence, later stages fail to unpack, raising the workload for reverse engineers.
Geofencing remains a key part of the operation. Earlier TimbreStealer activity returned harmless or blank files when accessed outside Mexico. The newer samples continue to show environment checks, including time zone validation consistent with Mexico and language or desktop checks used to detect sandboxes and analysis machines. Some samples reject Russian-language environments, a pattern seen across several crimeware families and often interpreted as an attempt to avoid unwanted attention in certain jurisdictions.
Once active, TimbreStealer is built for data theft. It targets browser stores from Chrome, Edge and their development variants, Firefox profiles, email clients such as Thunderbird and Postbox, and synchronised folders linked to OneDrive and Dropbox. Browser data is particularly valuable because it can contain saved credentials, cookies, session tokens and autofill records that allow attackers to hijack accounts without immediately triggering password-based controls.
The campaign’s focus on companies rather than broad consumer targeting raises the risk of follow-on compromise. Stolen browser sessions and mail data can enable business email compromise, supplier fraud, payroll diversion and deeper network access. In sectors that rely heavily on electronic invoices and tax documentation, a CFDI-themed lure is harder to dismiss because it mirrors daily administrative traffic.
The operators’ methods also reflect a wider trend in Latin America-focused cybercrime: highly localised social engineering combined with malware engineering that borrows from more advanced intrusion playbooks. Tax-season themes, invoice disputes and accounting attachments remain effective because they exploit workflow pressure rather than technical weakness alone. The shift to updater abuse and side-loaded DLLs shows that commodity information stealers are becoming more resilient against standard detection.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
