# Tax Season Phishing and Malware Campaign Targets Indian Taxpayers via Fake Income Tax Department Notices

> A coordinated, resourced campaign impersonates India's Income Tax Department, distributing the Windows credential-stealer ITD_Tax_Notice.exe and an Android APK dropper (ITD.zip) via WhatsApp messages disguised as penalty notices, backed by 30+ disposable phishing domains, an Alibaba Cloud (Hong Kong) second-stage staging host, and an abused Certum EV code-signing certificate. The malware intercepts SMS/OTP, harvests credentials and contacts, logs keystrokes, and overlays fake screens on banking apps, and is reinforced by a wider ecosystem of fake refund SMS, cloned e-Filing portal pages, fraudulent e-PAN emails, and scam tax-consultant fraud targeting Indian taxpayers during the ITR filing season.

- **Published:** 2026-07-30T00:00:00Z
- **Last reviewed:** 2026-07-30T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1769
- **ID:** TL-2026-1769
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 53 (full data via the Threadlinqs MCP server — Purple tier)

## Description

CloudSEK researchers (Shobhit Mishra, Jainam Shah) documented an active, live campaign exploiting India's Income Tax Return (ITR) filing season to distribute credential-stealing malware and run parallel social-engineering fraud against Indian taxpayers. The primary infection vector is WhatsApp: victims receive a bilingual (Hindi/English) fake 'Office Memorandum' penalty notice citing Sections 271(1)(c) and 276C of the Income Tax Act, 1961, spoofing a signatory ('Raj Kumar Sharma, Assistant Commissioner of Income Tax') and imposing a 72-hour compliance deadline to pressure victims into clicking a 'Download Documents' link.

That link resolves to one of 30+ disposable domains registered on cheap TLDs (.lol, .xin, .club, .lat, .ink, .shop, .click, .study, .bar, .cc, .live, .autos) using randomized consonant strings, each cloning official Income Tax Department page layouts and logos. Clicking through delivers either ITD_Tax_Notice.exe (Windows, PE32 GUI, Intel 80386, 3,265,096 bytes) or an ITD.zip archive containing a malicious Android APK (observed sample sizes 2 MB and 34-35 MB). The Windows binary is digitally signed with a legitimately-issued but abused Certum Extended Validation Code Signing 2021 CA certificate (serial 2D85A7A16D1EB86DFD92B00F6267733D), registered to a Chinese sole proprietor in Linyi, Shandong. The binary's PE version metadata falsely claims an original filename of svchost.exe and publisher 'Microsoft Windows' to blend in with legitimate system processes.

On execution, the dropper performs modified sleep-timing checks and virtualization/sandbox detection, then conducts registry, security-software, and system-information reconnaissance before deliberately exiting into Windows Error Reporting to frustrate automated analysis. It retrieves a second-stage payload (88.bin) from an Alibaba Cloud OSS bucket in Hong Kong (vss2.oss-cn-hongkong.aliyuncs.com, resolving to 47.79.66.58); the .bin file's near-maximum entropy (~8.0) and writeable .text section are consistent with in-memory shellcode/encrypted-blob execution designed to evade on-disk scanning. The malware additionally queries the legitimate geolocation service ipwho.is to profile victims. Combined Windows/Android capabilities documented by CloudSEK include SMS/OTP interception, credential and contact harvesting, keystroke logging, and overlay screens injected over banking and payment apps to steal login credentials -- consistent with TTPs seen in other Indian tax-themed Android banking trojans such as Drinik.

The malware operation sits inside a broader, coordinated fraud ecosystem targeting the same ITR filing season: fake refund SMS messages claiming refunds are 'pending, delayed, incomplete, or stuck'; fraudulent e-PAN emails offering fake e-PAN downloads or demanding manual document 're-verification' to release a refund (corroborated by India's PIB Fact Check unit, which separately warned of fake 'Download e-PAN Card Online' emails); cloned e-Filing portal pages replicating incometax.gov.in's layout to harvest credentials; and scam tax consultants who guarantee inflated refunds before reviewing actual income/TDS data, then either disappear with collected fees, harvest login/financial data, or file bogus deductions on the victim's behalf. CloudSEK assesses the operation as 'deliberate and sustained rather than opportunistic' based on the scale of registered infrastructure and resourcing, though it does not attribute the campaign to a named threat actor or nation-state; no CVE or CVSS applies, as no software vulnerability is exploited -- the chain is entirely social-engineering and malware-delivery based.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1608 Stage Capabilities
- T1588 Obtain Capabilities
- T1566 Phishing
- T1204 User Execution
- T1497 Virtualization/Sandbox Evasion
- T1574 Hijack Execution Flow
- T1055 Process Injection
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1553 Subvert Trust Controls
- T1012 Query Registry
- T1518 Software Discovery
- T1016 System Network Configuration Discovery
- T1082 System Information Discovery
- T1056 Input Capture
- T1417 Input Capture
- T1636 Protected User Data
- T1105 Ingress Tool Transfer
- T1071 Application Layer Protocol
- T1095 Non-Application Layer Protocol
- T1573 Encrypted Channel

## Sources

- [Tax Season, Open Season: Phishing and Malware Campaigns Targeting Indian Taxpayers](https://www.cloudsek.com/blog/tax-season-open-season-phishing-and-malware-campaigns-targeting-indian-taxpayers)
- [Advisory: Beware of Fake Income Tax Notices on WhatsApp](https://taxguru.in/income-tax/advisory-beware-fake-income-tax-notices-whatsapp.html)
- [Abuse of Indian Income Tax Themes to Execute Layered Attacks on Enterprises](https://cyberpress.org/income-tax-themed-attacks/)
- [Income Tax Department Phishing Campaign Uses Malicious Tax_Assessment.img to Drop Malware](https://cyberpress.org/tax-assessment-malware-scam/)
- [Government warns against fake emails asking users to download e-PAN cards](https://www.tribuneindia.com/news/cyber-security/government-warns-against-fake-emails-asking-users-to-download-e-pan-cards)
- [PIB Fact Check Warns Against Fake E-PAN Download Email](https://www.outlookmoney.com/personal-finance/pib-fact-check-warns-against-fake-e-pan-download-email)
- [Cyber Swachhta Kendra: Android Banker Trojan Alert](https://www.csk.gov.in/alerts/AndroidBankerTrojan.html)
- [Drinik malware returns to target Indian taxpayers](https://www.deccanherald.com/technology/drinik-malware-returns-to-target-indian-taxpayers-1157394)
- [CERT-In warns of WhatsApp malware campaign using fake invoices](https://www.newsbytesapp.com/news/science/cert-in-warns-of-whatsapp-malware-campaign-using-fake-invoices/story)
- [Drinik: Malware targeting Indian taxpayers for bank frauds resurfaces?](https://www.medianama.com/2022/11/223-android-malware-drinik-indain-taxpayers-it-dept-fraud/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1769