# Tax-Themed Phishing and Malware Campaign Targeting Indian Taxpayers: WhatsApp Fake ITD Notices (ITD.zip Android APK + Certum-Signed ITD_Tax_Notice.exe Loader), Cloned e-Filing Portals and Refund Scams

> CloudSEK (published 30 Jul 2026) documents a sustained, resourced, financially motivated phishing/malware campaign against Indian taxpayers during ITR season. Threat actors deliver forged Income Tax Department 'Office Memorandum' penalty notices (citing Sections 271(1)(c) and 276C of the Income Tax Act 1961 with a 72-hour deadline) over WhatsApp as an Android APK capable of SMS/OTP interception, contact harvesting, keylogging and banking-app overlays, and via 30+ lookalike domains distributing a Certum EV code-signed Windows loader (ITD_Tax_Notice.exe, MD5 dff2b7a23882445b4e354199bf38554f) that masquerades as svchost.exe and pulls an in-memory second stage (88.bin) from an Alibaba Cloud OSS host (47.79.66.58). Parallel scams include fake refund messages, cloned e-Filing portals and fake tax consultants.

- **Published:** 2026-09-25T00:00:00Z
- **Last reviewed:** 2026-09-25T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2654
- **ID:** TL-2026-2654
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)

## Description

CloudSEK threat researchers (Shobhit Mishra, Jainam Shah) documented a deliberate and sustained phishing and malware campaign targeting Indian taxpayers during the ITR filing season, published 30 July 2026 as 'Tax Season, Open Season'. No CVE is associated and no named threat-actor group is identified; the report characterises the effort as resourced and financially motivated rather than opportunistic, pointing to precise bilingual lure documents, real legal citations, and active payload rotation. The Income Tax Department of India does not serve statutory notices, penalty orders or summons over WhatsApp, which is the campaign's primary delivery channel.

The primary lure is a forged bilingual (Hindi/English) 'Office Memorandum' from the 'Income Tax Department of India, Aayakar Bhawan, New Delhi 110001', carrying the Government of India emblem, citing Section 271(1)(c) and Section 276C of the Income Tax Act 1961, demanding action within a 72-hour deadline, signed by a spoofed 'Raj Kumar Sharma, Assistant Commissioner of Income Tax' with a fabricated file number (e.g., No. TAX/PEN/2026-142). The notice is delivered by WhatsApp from unknown or compromised accounts flagged by the app as 'Not a contact'; observed sender display names include 'Sunil sharma', 'jankiforex' and 'Hotel Oyster' (none related to tax administration), and one sample was pushed inside a group chat. The attachment is ITD.zip, observed at three rotating sizes (2 MB, 34 MB, 35 MB) to defeat static signature detection. On mobile the payload is a malicious Android application (APK) that reads and intercepts SMS (banking OTPs), harvests contacts to spread further, captures keystrokes, and overlays fake screens on top of banking and payment apps to steal credentials.

A parallel web vector uses 30+ lookalike/disposable domains on cheap low-trust TLDs (.lol, .xin, .ink, .autos, .club, .lat, .study, .bar, .one, .shop, .click, .cc, .live, .com) to host forged Office Memorandums and cloned e-Filing portals that replicate the official incometax.gov.in look and harvest PAN, Aadhaar, password, OTP and bank-account details. The report stresses that stolen PAN alone is dangerous (it can be used to open accounts, apply for loans or launder money). For desktop/WhatsApp Web users, the same campaign distributes a signed Windows loader, ITD_Tax_Notice.exe (PE32 GUI, Intel 80386, 3,265,096 bytes; MD5 dff2b7a23882445b4e354199bf38554f; SHA-1 7479fbc27320ae246db9030cca80809ec63de0e9; SHA-256 667b37eafb9ec5131ed4f017ed429a47dca3adf626b2fc85fc6424b1e17ff6e1; import hash 538ad8e0ad1fec0ecc54f9e120ac6ff9). It is signed with a Certum Extended Validation Code Signing 2021 CA certificate (serial 2D85A7A16D1EB86DFD92B00F6267733D) issued to a Chinese sole proprietor in Linyi, Shandong, CN, and its version metadata claims the original filename svchost.exe, description 'Service Host', publisher 'Microsoft Windows'. The binary shows near-maximum entropy (~8.0) with a writeable .text section indicating a runtime packer. On detonation it fingerprints the machine via the ipwho.is geolocation service (a legitimate service abused for victim profiling and sandbox filtering), fetches a second-stage payload 88.bin from the Alibaba Cloud OSS bucket vss2.oss-cn-hongkong.aliyuncs.com (IP 47.79.66.58) and runs it in memory (shellcode or an encrypted blob), exhibits modified sleep behaviour and virtualisation/sandbox checks, performs registry, security-software and system-information reconnaissance, and ultimately exits into Windows Error Reporting. Only two network endpoints are observed, both legitimate services abused as infrastructure.

The report situates this within a wider tax-scam ecosystem active in the same season: (1) fake refund SMS/email/WhatsApp messages claiming a refund is pending/delayed/stuck and linking to fake e-Filing pages that harvest PAN, login credentials, OTPs and bank details; (2) cloned e-Filing portals harvesting PAN/Aadhaar/password/OTP/bank account numbers; (3) fake e-PAN or 'manual verification' emails (already flagged by India's PIB Fact Check) using 'Hello Taxpayer'/'Dear User' greetings and unexpected attachments; and (4) fake tax consultants/refund agents promising fast or inflated refunds, then collecting fees and vanishing or harvesting credentials. Refund-scam variants can end in account takeover, with scammers changing the victim's linked bank account to divert actual refunds. Related but separate tax-assessment phishing campaigns documented in the same period deliver commodity RATs (XWorm) via .NET loaders (e.g., harivo.vip hosting Tax_Assessment_0609.zip with libsvcs.dll, C2 103.231.12.27:4444) and in-memory malware (CYFIRMA 'Operation TaxShadow').

Defenders should treat the durable pattern as the signal: random consonant strings on cheap TLDs with no relation to any government namespace and a single call to action to download a file. Genuine Income Tax Department notices appear only inside a taxpayer's account on the official e-Filing portal (incometax.gov.in) and are verifiable via the Document Identification Number (DIN); the department never asks for OTPs, passwords or bank details. Reporting channels include the national cybercrime helpline 1930, the official cybercrime portal, webmanager@incometax.gov.in (for phishing emails/websites) and incident@cert-in.org.in.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1204.001 Malicious Link
- T1204.002 Malicious File
- T1583.001 Domains
- T1583.006 Web Services
- T1588.004 Digital Certificates
- T1574.001 DLL
- T1055 Process Injection
- T1027.002 Software Packing
- T1036.005 Match Legitimate Resource Name or Location
- T1497 Virtualization/Sandbox Evasion
- T1012 Query Registry
- T1518.001 Security Software Discovery
- T1082 System Information Discovery
- T1056.001 Keylogging
- T1636.004 SMS Messages
- T1071.001 Web Protocols

## Sources

- [Tax Season, Open Season: Phishing and Malware Campaigns Targeting Indian Taxpayers (CloudSEK)](https://www.cloudsek.com/blog/tax-season-open-season-phishing-and-malware-campaigns-targeting-indian-taxpayers)
- [OffSeq Threat Radar: Tax Season, Open Season (IOCs + MITRE)](https://radar.offseq.com/threat/tax-season-open-season-phishing-and-malware-campaigns-targeting-indian-taxpayers-add0b8b09e80d015)
- [Hendry Adrian mirror: Tax Season, Open Season (IOCs)](https://www.hendryadrian.com/tax-season-open-season-phishing-and-malware-campaigns-targeting-indian-taxpayers/)
- [Times of India (Bengaluru): Fake tax notices on WhatsApp target ITR filers; malware steals banking credentials](https://timesofindia.indiatimes.com/)
- [InfotechLead: India ITR Filing Scam Uses 72-Hour Fake Tax Notices and Cloned Income Tax Portals](https://infotechlead.com/security/india-itr-filing-scam-uses-72-hour-fake-tax-notices-2-mb-35-mb-malware-files-and-cloned-income-tax-portals-97375)
- [CyberSecurity Times: WhatsApp Tax Scam Uses 72-Hour Penalty Threat to Spread Banking Malware](https://cybersecuritytimes.com/)
- [Cybersecify: How to Spot an ITR Refund Scam in India (2026)](https://cybersecify.com/blog/itr-refund-scam-india-2026/)
- [Economic Times: Rs 6,000 tax-demand notice fake, PIB Fact Check warns of phishing](https://economictimes.indiatimes.com/wealth/tax/income-tax-department-rs-6000-payment-notice-fake-pib-fact-check-warns-taxpayers-about-phishing-scam/articleshow/133228943.cms)
- [Outlook Money: PIB Fact Check flags fake AY 2025-26 demand notices](https://www.outlookmoney.com/tax/urgent-alert-income-tax-department-flags-fake-ay-202526-demand-notices)
- [Moneycontrol: Fake 'compliance gaps' ITR emails flagged by PIB Fact Check](https://www.moneycontrol.com/technology/income-tax-filing-scam-email-claiming-compliance-gaps-in-returns-is-fake-government-warns-users-to-article-13869524.html)
- [Business Standard: Rs 6,000 tax-demand phishing scam warning](https://www.business-standard.com/finance/personal-finance/got-a-rs-6-000-tax-demand-govt-warns-it-could-be-a-phishing-scam-126081800523_1.html)
- [Income Tax Department: Report Phishing](https://www.incometaxindia.gov.in/report-phishing)
- [CYFIRMA: Operation TaxShadow — Multi-Region Tax Phishing In-Memory Malware Campaign](https://www.cyfirma.com/research/operation-taxshadow-multi-region-tax-phishing-in-memory-malware-campaign/)
- [Gurucul: An Income Tax Assessment Notice phishing campaign (XWorm RAT)](https://partner.gurucul.com/articles/ThreatResearch/An-Income-Tax-Assessment-Notice-24-6-2026)
- [CybersecurityNews: Fake Income Tax Assessment Notice delivers RAT-like malware to Windows users](https://cybersecuritynews.com/fake-income-tax-assessment-notice-delivers-rat-like-malware/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2654