Tax-Themed Phishing and Malware Campaign Targeting Indian Taxpayers: WhatsApp Fake ITD Notices (ITD.zip Android APK + Certum-Signed ITD_Tax_Notice.exe Loader), Cloned e-Filing Portals and Refund Scams

Key facts

Detection coverage

As of 2026-09-25, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2654 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: ITD_Tax_Notice Loader Execution or svchost Masquerade — Post-Exploitation Phase

Detects execution of the Certum EV code-signed Windows loader ITD_Tax_Notice.exe (MD5 dff2b7a23882445b4e354199bf38554f, SHA-256 667b37eafb9ec5131ed4f017ed429a47dca3adf626b2fc85fc6424b1e17ff6e1) masquerading as svchost.exe, and the runtime-packed 'Service Host' binary running from non-System32 paths with the OriginalFileName 'svchost.exe' and a non-Microsoft signer (the Linyi, Shandong CN sole-proprietor certificate is the T1588.004 artifact of the campaign). Also flags Sysmon EID 10 cross-process remote-thread creation as the loader's in-memory second stage (88.bin shellcode) is injected.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1204.002, T1036.005, T1027.002, T1055, T1588.004
• Data sources: sysmon_process_creation, sysmon_remote_thread, microsoft_defender_endpoint
• Severity: high
• Confidence: high

Splunk SPL

/* TL-2026-2654-SPL-002: ITD_Tax_Notice.exe loader, svchost masquerade, and cross-process injection (Sysmon EID 1 + 10) */
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
| search EventCode=1 OR EventCode=10
| eval suspicious = case(
    like(Image, "%ITD_Tax_Notice.exe"), "itd_loader_exec",
    (like(Image, "%svchost.exe") AND NOT like(Image, "C:\\Windows\\System32\\svchost.exe")), "svchost_non_system32_path",
    (like(OriginalFileName, "svchost.exe") AND NOT like(Signer, "%Microsoft%") AND NOT like(Image, "C:\\Windows\\System32\\svchost.exe")), "svchost_signer_masquerade",
    EventCode=10, "cross_process_remote_thread",
    1=1, null())
| where NOT isnull(suspicious)
| eval hash = coalesce(Hashes, SHA256)
| stats count min(_time) as first_seen max(_time) as last_seen by Computer, Image, CommandLine, OriginalFileName, Signer, hash, suspicious
| sort - count

Microsoft KQL

let StartTime = ago(24h);
(DeviceProcessEvents
| where TimeGenerated > StartTime
| where FileName == "ITD_Tax_Notice.exe"
   or (FileName == "svchost.exe" and FolderPath !startswith @"C:\Windows\System32")
   or (OriginalFileName == "svchost.exe" and FileName != "svchost.exe")
| project TimeGenerated, DeviceName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, Signer, SHA256 | extend IndicatorType = "loader_or_masquerade")
| union (DeviceEvents
| where TimeGenerated > StartTime
| where ActionType == "CreateRemoteThreadApiCall"
| where RemoteThreadStartModule has_any ("svchost.exe", "lsass.exe", "winlogon.exe", "explorer.exe")
| project TimeGenerated, DeviceName, ActionType, FileName, InitiatingProcessFileName, RemoteThreadStartModule, RemoteThreadStartAddress | extend IndicatorType = "process_injection")
| sort by TimeGenerated desc

Sigma

title: Suspicious ITD Tax Loader Execution or svchost Masquerade / Injection
id: 9d2e4a1c-7b3f-4e8a-8c2d-6f1a9b3c5d7e
status: experimental
description: Detects execution of the Certum Extended Validation-signed loader ITD_Tax_Notice.exe (abused code-signing certificate, T1588.004 artifact) and the accompanying svchost.exe masquerade — the loader presents OriginalFileName 'svchost.exe', Description 'Service Host' and publisher 'Microsoft Windows' while running from arbitrary writable paths with a non-Microsoft signer, then injects an in-memory second stage. Campaign documented by CloudSEK 2026-07-30.
references:
    - https://www.cloudsek.com/blog/tax-season-open-season-phishing-and-malware-campaigns-targeting-indian-taxpayers
    - https://cybersecuritytimes.com
author: Threadlinqs Team
date: 2026/09/25
tags:
    - attack.execution
    - attack.t1204.002
    - attack.defense-evasion
    - attack.t1036.005
    - attack.t1027.002
    - attack.t1055
    - attack.t1588.004
    - attack.tool.itd_tax_notice
logsource:
    category: process_creation
    product: windows
detection:
    selection_loader:
        Image|endswith: '\ITD_Tax_Notice.exe'
    selection_masq_path:
        Image|endswith: '\svchost.exe'
        Image|contains:
            - '\Temp\'
            - '\Downloads\'
            - '\AppData\'
            - '\Users\Public\'
    selection_masq_meta:
        OriginalFileName: 'svchost.exe'
        Description: 'Service Host'
    selection_remote_thread:
        TargetImage|endswith:
            - '\svchost.exe'
            - '\lsass.exe'
            - '\winlogon.exe'
        SourceImage|endswith: '\ITD_Tax_Notice.exe'
    filter_system32:
        Image|startswith: 'C:\Windows\System32'
    condition: (selection_loader or selection_masq_meta or selection_remote_thread) and not filter_system32 or (selection_masq_path and not filter_system32)
falsepositives:
    - Third-party agents that legitimately host a renamed svchost.exe in application directories (rare; verify signer)
    - Microsoft-signed svchost.exe spawned from %TEMP% by managed device-management agents
level: high

Known false positives:

• File-name collisions: unrelated utilities named ITD_Tax_Notice.exe (very rare)
• Managed hosts where MDM agents launch svchost.exe-payloads from non-System32 paths

Tuning notes: Correlate the EID 10 remote-thread hits with the loading process's Signer field — a trusted non-Microsoft signer in this pattern should still alert during ITR season. Add a second-stage correlation: a process matching this rule followed within 60s by an outbound request to oss-cn-hongkong.aliyuncs.com or 47.79.66.58 is critical.

• 🔒 Email/Web Delivery of ITD Phishing Lures or Lookalike Domains — Exploitation Phase · unlock with TL Creds
• 🔒 ITD Loader Execution, svchost Masquerade and Remote-Thread Injection — Post-Exploitation Phase · unlock with TL Creds
• 🔒 Outbound Staging to Alibaba OSS / 88.bin and [indicator] Profiling — C2 / Staging · unlock with TL Creds
• 🔒 Download or Query of ITD Tax-Phishing Lookalike Domains / Payloads — Exploitation Phase · unlock with TL Creds
• 🔒 Suspicious ITD Tax Loader Execution or svchost Masquerade / Injection — Post-Exploitation Phase · unlock with TL Creds
• 🔒 Alibaba OSS Second-Stage Fetch or [indicator] Geolocation Probe (Indian Tax Phishing) — C2 / Staging · unlock with TL Creds
• 🔒 ITD Lookalike Domain Query or Tax-Phishing Payload Download — Exploitation Phase · unlock with TL Creds
• 🔒 Alibaba OSS Second-Stage Fetch or [indicator] Geolocation Probe — C2 / Staging · unlock with TL Creds

Indicators of compromise

As of 2026-09-25, Threadlinqs Intelligence tracks 28 indicators of compromise for TL-2026-2654.

Sample indicators (3 of 28)

• IP address: 47.79.66[.]58
• Domain: apeal[.]lol
• File hash: dff2b7a23882445b4e354199bf38554f

Defanged, TLP:CLEAR. Full set of 28 indicators: unlock with TL Creds.

Technical analysis

Threat actors deliver forged Income Tax Department 'Office Memorandum' penalty notices (citing Sections 271(1)(c) and 276C of the Income Tax Act 1961 with a 72-hour deadline) over WhatsApp as an Android APK capable of SMS/OTP interception, contact harvesting, keylogging and banking-app overlays, and via 30+ lookalike domains distributing a Certum EV code-signed Windows loader (ITD_Tax_Notice.exe, MD5 dff2b7a23882445b4e354199bf38554f) that masquerades as svchost.exe and pulls an in-memory second stage (88.bin) from an Alibaba Cloud OSS host (47.79.66.58). Parallel scams include fake refund messages, cloned e-Filing portals and fake tax consultants.

CloudSEK threat researchers (Shobhit Mishra, Jainam Shah) documented a deliberate and sustained phishing and malware campaign targeting Indian taxpayers during the ITR filing season, published 30 July 2026 as 'Tax Season, Open Season'. No CVE is associated and no named threat-actor group is identified; the report characterises the effort as resourced and financially motivated rather than opportunistic, pointing to precise bilingual lure documents, real legal citations, and active payload rotation. The Income Tax Department of India does not serve statutory notices, penalty orders or summons over WhatsApp, which is the campaign's primary delivery channel.

The primary lure is a forged bilingual (Hindi/English) 'Office Memorandum' from the 'Income Tax Department of India, Aayakar Bhawan, New Delhi 110001', carrying the Government of India emblem, citing Section 271(1)(c) and Section 276C of the Income Tax Act 1961, demanding action within a 72-hour deadline, signed by a spoofed 'Raj Kumar Sharma, Assistant Commissioner of Income Tax' with a fabricated file number (e.g., No. TAX/PEN/2026-142). The notice is delivered by WhatsApp from unknown or compromised accounts flagged by the app as 'Not a contact'; observed sender display names include 'Sunil sharma', 'jankiforex' and 'Hotel Oyster' (none related to tax administration), and one sample was pushed inside a group chat. The attachment is ITD.zip, observed at three rotating sizes (2 MB, 34 MB, 35 MB) to defeat static signature detection. On mobile the payload is a malicious Android application (APK) that reads and intercepts SMS (banking OTPs), harvests contacts to spread further, captures keystrokes, and overlays fake screens on top of banking and payment apps to steal credentials.

A parallel web vector uses 30+ lookalike/disposable domains on cheap low-trust TLDs (.lol, .xin, .ink, .autos, .club, .lat, .study, .bar, .one, .shop, .click, .cc, .live, .com) to host forged Office Memorandums and cloned e-Filing portals that replicate the official incometax.gov.in look and harvest PAN, Aadhaar, password, OTP and bank-account details. The report stresses that stolen PAN alone is dangerous (it can be used to open accounts, apply for loans or launder money). For desktop/WhatsApp Web users, the same campaign distributes a signed Windows loader, ITD_Tax_Notice.exe (PE32 GUI, Intel 80386, 3,265,096 bytes; MD5 dff2b7a23882445b4e354199bf38554f; SHA-1 7479fbc27320ae246db9030cca80809ec63de0e9; SHA-256 667b37eafb9ec5131ed4f017ed429a47dca3adf626b2fc85fc6424b1e17ff6e1; import hash 538ad8e0ad1fec0ecc54f9e120ac6ff9). It is signed with a Certum Extended Validation Code Signing 2021 CA certificate (serial 2D85A7A16D1EB86DFD92B00F6267733D) issued to a Chinese sole proprietor in Linyi, Shandong, CN, and its version metadata claims the original filename svchost.exe, description 'Service Host', publisher 'Microsoft Windows'. The binary shows near-maximum entropy (~8.0) with a writeable .text section indicating a runtime packer. On detonation it fingerprints the machine via the ipwho.is geolocation service (a legitimate service abused for victim profiling and sandbox filtering), fetches a second-stage payload 88.bin from the Alibaba Cloud OSS bucket vss2.oss-cn-hongkong.aliyuncs.com (IP 47.79.66.58) and runs it in memory (shellcode or an encrypted blob), exhibits modified sleep behaviour and virtualisation/sandbox checks, performs registry, security-software and system-information reconnaissance, and ultimately exits into Windows Error Reporting. Only two network endpoints are observed, both legitimate services abused as infrastructure.

The report situates this within a wider tax-scam ecosystem active in the same season: (1) fake refund SMS/email/WhatsApp messages claiming a refund is pending/delayed/stuck and linking to fake e-Filing pages that harvest PAN, login credentials, OTPs and bank details; (2) cloned e-Filing portals harvesting PAN/Aadhaar/password/OTP/bank account numbers; (3) fake e-PAN or 'manual verification' emails (already flagged by India's PIB Fact Check) using 'Hello Taxpayer'/'Dear User' greetings and unexpected attachments; and (4) fake tax consultants/refund agents promising fast or inflated refunds, then collecting fees and vanishing or harvesting credentials. Refund-scam variants can end in account takeover, with scammers changing the victim's linked bank account to divert actual refunds. Related but separate tax-assessment phishing campaigns documented in the same period deliver commodity RATs (XWorm) via .NET loaders (e.g., harivo.vip hosting Tax_Assessment_0609.zip with libsvcs.dll, C2 103.231.12.27:4444) and in-memory malware (CYFIRMA 'Operation TaxShadow').

Defenders should treat the durable pattern as the signal: random consonant strings on cheap TLDs with no relation to any government namespace and a single call to action to download a file. Genuine Income Tax Department notices appear only inside a taxpayer's account on the official e-Filing portal (incometax.gov.in) and are verifiable via the Document Identification Number (DIN); the department never asks for OTPs, passwords or bank details. Reporting channels include the national cybercrime helpline 1930, the official cybercrime portal, webmanager@incometax.gov.in (for phishing emails/websites) and incident@cert-in.org.in.

MITRE ATT&CK techniques by tactic:

Discovery

T1012 Query Registry; T1082 System Information Discovery; T1518.001 Security Software Discovery

Defense Evasion

T1027.002 Software Packing; T1036.005 Match Legitimate Resource Name or Location; T1055 Process Injection; T1497 Virtualization/Sandbox Evasion; T1574.001 DLL

Credential Access

T1056.001 Keylogging

Command and Control

T1071.001 Web Protocols

Execution

T1204.001 Malicious Link; T1204.002 Malicious File

Initial Access

T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link

Resource Development

T1583.001 Domains; T1583.006 Web Services; T1588.004 Digital Certificates

Collection

T1636.004 SMS Messages

Remediation

Patches

• No vendor CVE patch applies; keep Android/Windows OS and AV/EDR signatures current and enable Google Play Protect real-time scanning

Immediate actions

• Treat any tax notice or refund message delivered via WhatsApp, SMS or email as potentially fraudulent; the Income Tax Department does not serve notices over WhatsApp
• Do not open ITD.zip attachments, tap 'Download Documents' buttons, or sideload APKs from unofficial sources
• Verify any notice's Document Identification Number (DIN) at incometax.gov.in and check messages only inside the official e-Filing portal
• Never share OTPs, passwords, PAN/Aadhaar numbers or bank details in response to tax communications
• Block the listed lookalike domains and the staging host vss2.oss-cn-hongkong.aliyuncs.com at the perimeter

Workarounds

• If ITD.zip was opened, disconnect the device, change passwords from a clean device, enable MFA, run a full malware scan, and monitor bank- and PAN-linked accounts
• Report incidents to the national cybercrime helpline 1930 or the official cybercrime portal; forward phishing emails to webmanager@incometax.gov.in and incident@cert-in.org.in

Longer-term hardening

• Run short awareness briefings for staff during ITR filing season, especially finance and HR teams who receive compliance-notice lures
• Block newly registered and low-trust TLDs (.lol, .xin, .ink, .autos, .club, .lat, .study, .bar, .one, .shop, .click, .cc, .live) at the gateway
• Flag inbound archives (ZIP, disk images) and web-style files; watch for unusual svchost.exe paths, hidden system folders and unexpected outbound connections
• Enable MFA and set daily UPI/transaction limits to contain credential theft and account draining
• Deploy EDR/behavioral detection for in-memory payloads, process injection and packing

Affected and fixed versions

• N/A (social engineering) — Indian taxpayers / ITR filers (individuals)
• N/A (social engineering) — Businesses and finance/HR teams receiving compliance-notice lures
• Android — Android devices (malicious APK sideload)
• Microsoft — Windows (ITD_Tax_Notice.exe loader)

Timeline

• 2026-03-10 PIB Fact Check flags fake Income Tax demand-notice emails (AY 2025-26 'compliance gaps' and Rs 6,000-demand variants); ITD reiterates it never asks for OTPs, passwords or bank details and that legitimate notices are verifiable via DIN on the e-Filing portal.
• 2026-06-24 Analysts document a related Income Tax Assessment Notice phishing campaign delivering XWorm RAT via harivo.vip (Tax_Assessment_0609.zip, .NET loader, libsvcs.dll, C2 103.231.12.27:4444); CYFIRMA separately publishes 'Operation TaxShadow' in-memory tax-phishing research.
• 2026-07-30 CloudSEK rates the campaign as deliberate and sustained rather than opportunistic, citing precise bilingual lure documents, real legal citations, and active payload rotation.
• 2026-07-30 Sandbox analysis of locked-ioc-8: Certum EV code-signed (Linyi, Shandong CN), masquerades as svchost.exe, near-maximum entropy runtime packer; fingerprints machine via locked-ioc-22, fetches 88.bin from locked-ioc-4 (locked-ioc-14), runs it in memory, modified sleep behaviour, registry/security/system recon, exits to Windows Error Reporting.
• 2026-07-30 Android APK analysis: reads/intercepts SMS banking OTPs, harvests contacts, captures keystrokes, and overlays fake screens on banking and payment apps to steal credentials.
• 2026-07-30 30+ lookalike domains on 14 low-trust TLDs (.lol, .xin, .ink, .autos, .club, .lat, .study, .bar, .one, .shop, .click, .cc, .live, .com) host forged memoranda and cloned e-Filing portals; fake refund SMS/email and fake tax-consultant variants active.
• 2026-07-30 Delivery from at least three unknown/compromised WhatsApp accounts flagged 'Not a contact' (display names 'Sunil sharma', 'jankiforex', 'Hotel Oyster'); one sample pushed inside a group chat.
• 2026-07-30 Fake notices observed citing Sections 271(1)(c) and 276C of the Income Tax Act 1961 with a 72-hour deadline, spoofed signatory 'Raj Kumar Sharma, Assistant Commissioner of Income Tax', file No. TAX/PEN/2026-142, bilingual Hindi/English with the Government of India emblem.
• 2026-07-30 CloudSEK publishes 'Tax Season, Open Season' documenting the campaign: forged ITD penalty-notice Office Memorandums delivered on WhatsApp as locked-ioc-23, with rotating archive sizes 2/34/35 MB observed.
• 2026-07-31 Times of India and security press amplify the warning to ITR filers; follow-up reporting documents account-takeover and refund-diversion fraud variants and real victim losses during the season.

Sources cited

• Tax Season, Open Season: Phishing and Malware Campaigns Targeting Indian Taxpayers (CloudSEK) cloudsek.com · Research · 2026-07-30
• OffSeq Threat Radar: Tax Season, Open Season (IOCs + MITRE) radar.offseq.com · Research · 2026-07-30
• Hendry Adrian mirror: Tax Season, Open Season (IOCs) hendryadrian.com · Research · 2026-07-30
• Income Tax Department: Report Phishing incometaxindia.gov.in · Vendor report · 2026-07-30
• CYFIRMA: Operation TaxShadow — Multi-Region Tax Phishing In-Memory Malware Campaign cyfirma.com · Research · 2026-06-24
• Gurucul: An Income Tax Assessment Notice phishing campaign (XWorm RAT) partner.gurucul.com · Research · 2026-06-24
• Cybersecify: How to Spot an ITR Refund Scam in India (2026) cybersecify.com · Blog · 2026-08-01
• Times of India (Bengaluru): Fake tax notices on WhatsApp target ITR filers; malware steals banking credentials timesofindia.indiatimes.com · News · 2026-07-30
• InfotechLead: India ITR Filing Scam Uses 72-Hour Fake Tax Notices and Cloned Income Tax Portals infotechlead.com · News · 2026-08-01
• CyberSecurity Times: WhatsApp Tax Scam Uses 72-Hour Penalty Threat to Spread Banking Malware cybersecuritytimes.com · News · 2026-07-30
• Economic Times: Rs 6,000 tax-demand notice fake, PIB Fact Check warns of phishing economictimes.indiatimes.com · News · 2026-03-10
• Outlook Money: PIB Fact Check flags fake AY 2025-26 demand notices outlookmoney.com · News · 2026-03-10
• Moneycontrol: Fake 'compliance gaps' ITR emails flagged by PIB Fact Check moneycontrol.com · News · 2026-03-10
• Business Standard: Rs 6,000 tax-demand phishing scam warning business-standard.com · News · 2026-03-10
• CybersecurityNews: Fake Income Tax Assessment Notice delivers RAT-like malware to Windows users cybersecuritynews.com · News · 2026-06-24

More in phishing

• Utility Impostor Scams: Lookalike Domains, Scam Ads and Phishing-as-a-Service (Darcula V3) Targeting Utility Customers
• 110-Domain Fake Copyright-Strike (DMCA/YouTube) Phishing Estate Using Browser-in-the-Browser Google Credential Harvesting
• SkyW4lker-Associated Microsoft OAuth Phishing via Adobe-Hosted PDF Lure (slybee.com)
• Holiday Phishing Scams 2026: Black Friday-Themed Phishing, Quishing, Callback Fraud and BEC Targeting Employees
• BluePhishing: Initial Access via Third-Party Agent Blueprint Consent (Microsoft Entra Agent ID)

Previous and next in phishing

• Fake Claude Max Giveaway Phishing Campaign Uses Browser-in-the-Browser to Steal Google Credentials Previous report
• Google Account Security Team Impersonation Vishing Campaign — Telegram Recruitment Ad Leaks Call Script Next report