Threat reportMalwareTL-2026-1769
Tax Season Phishing and Malware Campaign Targets Indian Taxpayers via Fake Income Tax Department Notices
Tax Season Phishing and Malware Campaign Targets Indian (TL-2026-1769), also tracked as Tax Season, Open Season Campaign, is a high-severity malware campaign, first published 2026-07-30. It has no confirmed attribution, affects Microsoft Windows (Win32/PE32 endpoints), maps to 22 MITRE ATT&CK techniques (T1012, T1016, T1027), and is covered by 9 detection rules and 53 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 22MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 53Indicators of compromise
Key facts for TL-2026-1769
- Threat ID
- TL-2026-1769
- Also known as
- Tax Season, Open Season Campaign, ITD_Tax_Notice.exe Campaign, ITD.zip / Fake ITD Penalty Notice Campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- consumer, finance, government administration, professionalservices, smallbusiness
- Target regions
- india, South Asia
- Detection rules
- 9
- Indicators of compromise
- 53
Malware and tooling in Tax Season Phishing and Malware Campaign Targets Indian
Malware and tooling: ITD.zip Android APK dropper, ITD_Tax_Notice Windows credential stealer
How Tax Season Phishing and Malware Campaign Targets Indian works
A coordinated, resourced campaign impersonates India's Income Tax Department, distributing the Windows credential-stealer ITD_Tax_Notice.exe and an Android APK dropper (ITD.zip) via WhatsApp messages disguised as penalty notices, backed by 30+ disposable phishing domains, an Alibaba Cloud (Hong Kong) second-stage staging host, and an abused Certum EV code-signing certificate. The malware intercepts SMS/OTP, harvests credentials and contacts, logs keystrokes, and overlays fake screens on banking apps, and is reinforced by a wider ecosystem of fake refund SMS, cloned e-Filing portal pages, fraudulent e-PAN emails, and scam tax-consultant fraud targeting Indian taxpayers during the ITR filing season.
CloudSEK researchers (Shobhit Mishra, Jainam Shah) documented an active, live campaign exploiting India's Income Tax Return (ITR) filing season to distribute credential-stealing malware and run parallel social-engineering fraud against Indian taxpayers. The primary infection vector is WhatsApp: victims receive a bilingual (Hindi/English) fake 'Office Memorandum' penalty notice citing Sections 271(1)(c) and 276C of the Income Tax Act, 1961, spoofing a signatory ('Raj Kumar Sharma, Assistant Commissioner of Income Tax') and imposing a 72-hour compliance deadline to pressure victims into clicking a 'Download Documents' link.
That link resolves to one of 30+ disposable domains registered on cheap TLDs (.lol, .xin, .club, .lat, .ink, .shop, .click, .study, .bar, .cc, .live, .autos) using randomized consonant strings, each cloning official Income Tax Department page layouts and logos. Clicking through delivers either ITD_Tax_Notice.exe (Windows, PE32 GUI, Intel 80386, 3,265,096 bytes) or an ITD.zip archive containing a malicious Android APK (observed sample sizes 2 MB and 34-35 MB). The Windows binary is digitally signed with a legitimately-issued but abused Certum Extended Validation Code Signing 2021 CA certificate (serial 2D85A7A16D1EB86DFD92B00F6267733D), registered to a Chinese sole proprietor in Linyi, Shandong. The binary's PE version metadata falsely claims an original filename of svchost.exe and publisher 'Microsoft Windows' to blend in with legitimate system processes.
On execution, the dropper performs modified sleep-timing checks and virtualization/sandbox detection, then conducts registry, security-software, and system-information reconnaissance before deliberately exiting into Windows Error Reporting to frustrate automated analysis. It retrieves a second-stage payload (88.bin) from an Alibaba Cloud OSS bucket in Hong Kong (vss2.oss-cn-hongkong.aliyuncs.com, resolving to 47.79.66.58); the .bin file's near-maximum entropy (~8.0) and writeable .text section are consistent with in-memory shellcode/encrypted-blob execution designed to evade on-disk scanning. The malware additionally queries the legitimate geolocation service ipwho.is to profile victims. Combined Windows/Android capabilities documented by CloudSEK include SMS/OTP interception, credential and contact harvesting, keystroke logging, and overlay screens injected over banking and payment apps to steal login credentials -- consistent with TTPs seen in other Indian tax-themed Android banking trojans such as Drinik.
The malware operation sits inside a broader, coordinated fraud ecosystem targeting the same ITR filing season: fake refund SMS messages claiming refunds are 'pending, delayed, incomplete, or stuck'; fraudulent e-PAN emails offering fake e-PAN downloads or demanding manual document 're-verification' to release a refund (corroborated by India's PIB Fact Check unit, which separately warned of fake 'Download e-PAN Card Online' emails); cloned e-Filing portal pages replicating incometax.gov.in's layout to harvest credentials; and scam tax consultants who guarantee inflated refunds before reviewing actual income/TDS data, then either disappear with collected fees, harvest login/financial data, or file bogus deductions on the victim's behalf. CloudSEK assesses the operation as 'deliberate and sustained rather than opportunistic' based on the scale of registered infrastructure and resourcing, though it does not attribute the campaign to a named threat actor or nation-state; no CVE or CVSS applies, as no software vulnerability is exploited -- the chain is entirely social-engineering and malware-delivery based.
MITRE ATT&CK techniques used in TL-2026-1769
Discovery
T1012 Query Registry; T1016 System Network Configuration Discovery; T1082 System Information Discovery; T1518 Software Discovery
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection; T1497 Virtualization/Sandbox Evasion; T1574 Hijack Execution Flow
Collection
T1056 Input Capture; T1417 Input Capture; T1636 Protected User Data
Command and Control
T1071 Application Layer Protocol; T1095 Non-Application Layer Protocol; T1105 Ingress Tool Transfer; T1573 Encrypted Channel
Execution
defense-impairment
Initial Access
Resource Development
T1583 Acquire Infrastructure; T1588 Obtain Capabilities; T1608 Stage Capabilities
Affected products and versions in Tax Season Phishing and Malware Campaign Targets Indian
- Microsoft — Windows (Win32/PE32 endpoints)
Vulnerable versions: All supported Windows versions capable of executing a user-run PE32 binary -- delivered via social engineering, not an OS vulnerability - Google — Android OS
Vulnerable versions: Android devices with sideloading of unsigned/untrusted APKs enabled - Government of India — Income Tax Department / e-Filing Portal (impersonated brand, incometax.gov.in)
Vulnerable versions: N/A -- brand and website impersonation, not a software vulnerability
Remediation for Tax Season Phishing and Malware Campaign Targets Indian
Immediate actions
- Block/deny at DNS, web proxy, and firewall the 30+ identified malicious domains and the vss2.oss-cn-hongkong.aliyuncs.com staging host / 47.79.66.58
- Alert users organization-wide that the Income Tax Department never serves statutory notices, penalty orders, or summons via WhatsApp, SMS, or unsolicited email
- Instruct staff and taxpayers to never open unsolicited .exe, .apk, .zip, or document attachments received via WhatsApp claiming to be tax notices, refund alerts, or e-PAN files
- Hunt EDR/AV telemetry for the ITD_Tax_Notice.exe hash set (SHA-256/SHA-1/MD5/imphash) and for processes falsely claiming svchost.exe identity running outside System32
- Add the abused Certum EV code-signing certificate (serial 2D85A7A16D1EB86DFD92B00F6267733D) to application-control deny lists
Workarounds
- Verify any purported tax notice exclusively by logging into the official Income Tax e-Filing Portal (Pending Actions / e-Proceedings sections) via a bookmarked URL, never a link or attachment from an inbound message
- If already compromised: disconnect the device from the network, change all passwords from a clean device, enable MFA, run a full malware scan, and monitor financial accounts
- Report suspected fake notices or malware to the national cybercrime helpline 1930 or the official cybercrime portal
Longer-term hardening
- Deploy EDR/behavioral detection tuned for DLL side-loading, process injection, sandbox-evasion timing checks, and unexpected outbound connections to cloud object-storage endpoints rather than relying on static signatures alone
- Enforce mobile application vetting and block APK sideloading on managed corporate Android devices
- Run recurring tax-season security-awareness briefings for finance and HR teams covering WhatsApp/SMS/email tax-notice lures and fake tax-consultant fraud
- Establish email/web gateway rules to flag or block archive (.zip) and disk-image attachments from unauthenticated senders during the ITR filing season
- Route all tax-filing engagements through department-verified professionals rather than unsolicited consultants
Timeline of Tax Season Phishing and Malware Campaign Targets Indian
- Drinik, an Android banking trojan impersonating India's Income Tax Department, is first identified -- establishing the TTP lineage (SMS/OTP interception, credential harvesting, fake ITD-branded lures) that this campaign's Android capabilities closely resemble.
- CyberPress reports an earlier wave of income-tax-themed layered attacks on enterprises during ITR season, showing the tax-lure ecosystem was already active against Indian organizations before this campaign's WhatsApp-delivered malware was documented.
- Contextual/adjacent reporting: 'Rokarolla' Android banking trojan documented targeting banking and crypto users in India with device-takeover capability, illustrating the wider active landscape of Indian-taxpayer-targeting mobile malware this campaign sits within.
- CyberPress documents a related Income Tax Department phishing campaign delivering malware via a malicious Tax_Assessment.img/Tax_Assessment_0609.zip disk image, using the same government-brand-impersonation lure pattern later seen in the ITD_Tax_Notice.exe campaign.
- Second-stage payload 88.bin is identified staged on an Alibaba Cloud OSS bucket in Hong Kong (vss2.oss-cn-hongkong.aliyuncs.com, 47.79.66.58), exhibiting near-maximum entropy consistent with in-memory shellcode execution.
- CloudSEK researchers detonate the ITD_Tax_Notice.exe sample in a sandbox, observing modified sleep-timing and virtualization/sandbox-evasion checks, followed by registry, security-software, and system-information reconnaissance, before the process exits into Windows Error Reporting.
- ITD_Tax_Notice.exe and the ITD.zip Android APK are actively distributed via WhatsApp messages disguised as a fake Office Memorandum penalty notice, directing victims to one of 30+ disposable phishing domains.
- India's CERT-In issues a cybersecurity alert (reported by NewsBytes) warning of a WhatsApp-delivered malware campaign using fake invoice lures, corroborating WhatsApp as an active, officially-flagged malware distribution channel in the same period as this campaign.
- India's PIB Fact Check unit publicly warns against fraudulent 'Download e-PAN Card Online' emails harvesting personal/financial information -- part of the same broader tax-season fraud ecosystem.
- TaxGuru publishes an advisory warning taxpayers of fake Income Tax Department penalty notices sent via WhatsApp, citing Sections 271(1)(c) and 276C of the Income Tax Act, 1961, with a 72-hour compliance deadline.
- CloudSEK publishes 'Tax Season, Open Season', documenting the ITD_Tax_Notice.exe / ITD.zip campaign as live, resourced, and sustained, with full file hashes, 30+ domains, the abused Certum EV certificate, and Alibaba Cloud Hong Kong infrastructure.
Sources cited for Tax Season Phishing and Malware Campaign Targets Indian
- Tax Season, Open Season: Phishing and Malware Campaigns Targeting Indian Taxpayers
- Advisory: Beware of Fake Income Tax Notices on WhatsApp
- Abuse of Indian Income Tax Themes to Execute Layered Attacks on Enterprises
- Income Tax Department Phishing Campaign Uses Malicious Tax_Assessment.img to Drop Malware
- Government warns against fake emails asking users to download e-PAN cards
- PIB Fact Check Warns Against Fake E-PAN Download Email
- Cyber Swachhta Kendra: Android Banker Trojan Alert
- Drinik malware returns to target Indian taxpayers
- CERT-In warns of WhatsApp malware campaign using fake invoices
- Drinik: Malware targeting Indian taxpayers for bank frauds resurfaces?
Detection coverage for TL-2026-1769
As of 2026-07-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1769 across Splunk SPL, Microsoft KQL and Sigma, covering 53 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.