Tax-Season Phishing and Malware Campaigns Impersonating India's Income Tax Department Targeting Indian Taxpayers (ITD.zip / ITD_Tax_Notice.exe)

Key facts

Detection coverage

As of 2026-11-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5858 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: ITD_Tax_Notice.exe Loader Execution (Fake Income Tax Dept Notice) - Exploitation

Detects execution of the ITD_Tax_Notice.exe first-stage loader delivered by the 'Download Documents' lure in the 2026 Indian Income Tax Department impersonation campaign (TL-2026-5858). Matches the known file name, SHA256/SHA1/MD5/imphash from the CloudSEK report, and the svchost-lookalike version info ('Service Host' / 'Windows Software Development Team') carried by the packed, EV-signed PE. Flags whether the binary ran from a user-writable path.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1204.002, T1036.005, T1027.002
• Data sources: sysmon, index=sysmon sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational (EventCode 1), Microsoft Defender for Endpoint DeviceProcessEvents
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (Image="*ITD_Tax_Notice.exe" OR Hashes="*667B37EAFB9EC5131ED4F017ED429A47DCA3ADF626B2FC85FC6424B1E17FF6E1*" OR Hashes="*DFF2B7A23882445B4E354199BF38554F*" OR Hashes="*7479FBC27320AE246DB9030CCA80809EC63DE0E9*" OR Hashes="*538AD8E0AD1FEC0ECC54F9E120AC6FF9*" OR (Company="Windows Software Development Team" Description="Service Host"))
| eval detection_reason=case(match(Image,"(?i)ITD_Tax_Notice[.]exe$"),"known_filename",match(Hashes,"(?i)(667B37EAFB9EC513|DFF2B7A23882445B|7479FBC27320AE24|538AD8E0AD1FEC0E)"),"known_hash",true(),"svchost_lookalike_version_info")
| eval user_writable_path=if(match(Image,"(?i)^[a-z]:.(Users.+.(Downloads|AppData|Desktop|Temp)|Users.Public|ProgramData|Windows.Temp)."),"yes","no")
| fillnull value="unknown" User ParentImage CommandLine
| stats count min(_time) as first_seen max(_time) as last_seen values(detection_reason) as detection_reason values(Hashes) as Hashes values(CommandLine) as CommandLine by host User Image ParentImage user_writable_path
| convert ctime(first_seen) ctime(last_seen)
| table first_seen last_seen host User Image ParentImage CommandLine Hashes detection_reason user_writable_path count

Microsoft KQL

let itd_hashes = dynamic(["667b37eafb9ec5131ed4f017ed429a47dca3adf626b2fc85fc6424b1e17ff6e1","7479fbc27320ae246db9030cca80809ec63de0e9","dff2b7a23882445b4e354199bf38554f"]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "ITD_Tax_Notice.exe" or SHA256 in~ (itd_hashes) or SHA1 in~ (itd_hashes) or MD5 in~ (itd_hashes) or (ProcessVersionInfoCompanyName =~ "Windows Software Development Team" and ProcessVersionInfoFileDescription =~ "Service Host")
| extend InUserWritablePath = FolderPath has_any ("Downloads","AppData","Temp","Public","Desktop","ProgramData")
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, ProcessVersionInfoCompanyName, ProcessVersionInfoFileDescription, SHA256, InUserWritablePath, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc

Sigma

title: ITD_Tax_Notice.exe Execution Impersonating Indian Income Tax Department Lure
id: a1f3c8e2-4b97-4d6a-8c15-7e29b0d3f501
status: experimental
description: Detects execution of the ITD_Tax_Notice.exe first-stage loader by known file name, SHA256/SHA1/MD5/imphash, or version info masquerading as svchost.exe (Service Host / Windows Software Development Team), as reported by CloudSEK for the 2026 Indian tax-season campaign.
references:
    - https://www.cloudsek.com/blog/tax-season-open-season-phishing-and-malware-campaigns-targeting-indian-taxpayers
author: Threadlinqs Team
date: 2026/11/12
tags:
    - attack.execution
    - attack.t1204.002
    - attack.defense-evasion
    - attack.t1036.005
    - attack.t1027.002
logsource:
    category: process_creation
    product: windows
detection:
    selection_name:
        Image|endswith: '\ITD_Tax_Notice.exe'
    selection_hash:
        Hashes|contains:
            - 'SHA256=667B37EAFB9EC5131ED4F017ED429A47DCA3ADF626B2FC85FC6424B1E17FF6E1'
            - 'SHA1=7479FBC27320AE246DB9030CCA80809EC63DE0E9'
            - 'MD5=DFF2B7A23882445B4E354199BF38554F'
            - 'IMPHASH=538AD8E0AD1FEC0ECC54F9E120AC6FF9'
    selection_versioninfo:
        Company: 'Windows Software Development Team'
        Description: 'Service Host'
    condition: 1 of selection_*
falsepositives:
    - Internal tooling that reuses the same version-info strings
level: high

Known false positives:

• Legitimate internal software that happens to ship with the same 'Service Host' / 'Windows Software Development Team' version strings
• Security teams detonating the sample in a lab or sandbox that forwards Sysmon logs

Tuning notes: Exclude known malware-analysis hosts by host/index. The hash and filename branches are high fidelity but will not survive payload rotation; keep the version-info and user-writable-path branches. Update hash lists as new ITD_Tax_Notice.exe builds are published.

• 🔒 [indicator] / [indicator] Dropped to Disk from Fake Tax Notice Lure - Exploitation · unlock with TL Creds
• 🔒 svchost.exe Masquerade Outside System Directories / Certum EV Signing Cert Serial - Post-Exploitation · unlock with TL Creds
• 🔒 [indicator] Geolocation Lookup by Non-Browser Process - C2/Victim Profiling · unlock with TL Creds
• 🔒 DNS Resolution of Income Tax Department Lookalike Lure Domains - Exploitation · unlock with TL Creds
• 🔒 Unsigned DLL Loaded Beside Process in User-Writable Folder (Side-Loading) - Post-Exploitation · unlock with TL Creds
• 🔒 Non-Browser Process in User-Writable Path Contacting Alibaba Cloud OSS (aliyuncs.com) - C2/Staging · unlock with TL Creds
• 🔒 Sandbox, Security-Software and System Recon Burst from User-Writable Process - Post-Exploitation · unlock with TL Creds
• 🔒 Second-Stage [indicator] Staging Contact to Alibaba OSS [indicator] - C2/Staging · unlock with TL Creds

Indicators of compromise

As of 2026-11-12, Threadlinqs Intelligence tracks 28 indicators of compromise for TL-2026-5858.

Sample indicators (3 of 28)

• IP address: 47.79.66[.]58
• Domain: vss2[.]oss-cn-hongkong[.]aliyuncs[.]com
• File hash: 667b37eafb9ec5131ed4f017ed429a47dca3adf626b2fc85fc6424b1e17ff6e1

Defanged, TLP:CLEAR. Full set of 28 indicators: unlock with TL Creds.

Technical analysis

CloudSEK (2026-07-30) documents multiple overlapping tax-season campaigns aimed at Indian taxpayers during and just after the 2026 ITR filing window. The WhatsApp lure is a forged Income Tax Department Office Memorandum (fake file number TAX/PEN/2026-142, spoofed signatory 'Raj Kumar Sharma, Assistant Commissioner of Income Tax', citations of Sections 271(1)(c) and 276C of the Income Tax Act 1961, a 72-hour deadline, bilingual Hindi/English text) sent from unknown or compromised accounts with no tax-related identity, with a ZIP named ITD.zip. The ZIP contains an Android APK; the archive was observed at rotating sizes (2 MB, 34 MB, 35 MB), indicating payload rotation. The APK is described as requesting broad permissions, reading/intercepting SMS (including bank OTPs), harvesting contacts to spread itself, capturing keystrokes and overlaying fake screens on banking and payment apps.

A second lure uses newly registered lookalike domains (about 31 listed in the source, e.g. apeal.lol, laoshunfa.xyz, gov-xnui.com, indiaaba.com) hosting the same forged notice with a 'Download Documents' button that delivers Windows malware instead of documents. The sample ITD_Tax_Notice.exe is a 3,265,096-byte PE32 GUI executable (SHA-256 667b37eafb9ec5131ed4f017ed429a47dca3adf626b2fc85fc6424b1e17ff6e1) with version metadata masquerading as svchost.exe ('Service Host', 'Microsoft Windows', company 'Windows Software Development Team'), near-8.0 entropy and a writeable .text section suggesting in-memory unpacking, and a valid EV code-signing certificate from Certum Extended Validation Code Signing 2021 CA issued to a Chinese sole proprietor in Linyi, Shandong (serial 2D85A7A16D1EB86DFD92B00F6267733D) that does not match a Microsoft binary.

At runtime the small packed first stage queries the legitimate geolocation service ipwho.is, then fetches 88.bin from https://vss2.oss-cn-hongkong.aliyuncs.com/ (Alibaba Cloud OSS, Hong Kong; resolves to 47.79.66.58). The second stage is assessed as likely shellcode or an encrypted blob run in memory. CloudSEK observed modified sleep behaviour and virtualization checks followed by registry, security-software and system-information reconnaissance, after which the process exits into Windows Error Reporting. Only two endpoints were observed (Alibaba Cloud and ipwho.is), both legitimate services. CloudSEK links the web-lure flow to RAT/infostealer delivery in 2026 income-tax campaigns, with sideloading of a signed binary from an archive or disk image, but names no malware family and no threat actor; the RAT/infostealer characterization of the Windows payload is the vendor's assessment, not a confirmed family identification.

The wider ecosystem includes refund SMS/email fraud, cloned e-Filing portals harvesting PAN, Aadhaar, passwords, OTPs and bank details, fake e-PAN files, and fraudulent tax consultants. Independent reporting describes related but distinct income-tax-themed campaigns (Seqrite/eSecurityPlanet, December 2025: image-only emails, 'Review Annexure.pdf', fake ITD Compliance Portal, NSIS-based installer and persistent RAT; CyFirma, June 2026: Tax_Assessment.exe, XWorm-like .NET RAT). These are not shown to share infrastructure with the CloudSEK campaign and should not be treated as the same cluster without further evidence. No BeaconBeagle correlation could be obtained (API returned HTTP 502).

MITRE ATT&CK techniques by tactic:

Discovery

T1012 Query Registry; T1082 System Information Discovery; T1518.001 Security Software Discovery

Defense Evasion

T1027.002 Software Packing; T1036.005 Match Legitimate Resource Name or Location; T1055 Process Injection; T1497 Virtualization/Sandbox Evasion; T1574.001 DLL

Command and Control

T1071 Application Layer Protocol; T1095 Non-Application Layer Protocol; T1573 Encrypted Channel

Execution

T1204.002 Malicious File

defense-impairment

T1553.002 Code Signing

Initial Access

T1566.002 Spearphishing Link

Resource Development

T1583.001 Domains; T1608.001 Upload Malware

Remediation

Immediate actions

• Block the listed lookalike domains, vss2.oss-cn-hongkong.aliyuncs.com and 47.79.66.58 at DNS/proxy/firewall
• Hunt for ITD.zip and ITD_Tax_Notice.exe by name and SHA-256 667b37eafb9ec5131ed4f017ed429a47dca3adf626b2fc85fc6424b1e17ff6e1
• If ITD.zip or similar was opened, disconnect the device, change passwords from a clean device (email and banking first), enable MFA, run a full malware scan and monitor bank and PAN-linked accounts

Workarounds

• Treat any tax notice received via WhatsApp or SMS as fake; reach the e-Filing portal only by typing the official address and verify the Document Identification Number (DIN)
• Never share OTPs, passwords or bank details in response to an unsolicited message; report to 1930 or the national cybercrime portal

Longer-term hardening

• Run filing-season awareness briefings for finance, HR and compliance staff
• Block newly registered and low-trust TLDs where feasible and flag inbound archives and disk-image files for review
• Route tax filings through in-house experts or verified professionals so unexpected notices stand out
• Monitor for svchost.exe running from unusual paths, hidden system-folder directories, script engines running web-style files and unexpected outbound connections

Affected and fixed versions

• Google — Android
  Vulnerable versions: Devices that install sideloaded APKs received over chat
• Microsoft — Windows
  Vulnerable versions: Desktop systems where users run the downloaded executable (including via WhatsApp Web)

Timeline

• 2025-12-23 eSecurityPlanet, citing Seqrite research, reports a related (not shown to be the same cluster) income-tax-themed campaign using image-only emails, 'Review Annexure.pdf' and a fake ITD Compliance Portal delivering a persistent RAT.
• 2026-06-23 CYFIRMA publishes a related income-tax assessment notice campaign delivering Tax_Assessment.exe, an XWorm-like .NET RAT; no attribution confirmed.
• 2026-07-30 As of the CloudSEK report the campaigns are assessed as sustained and resourced with active payload rotation; no actor or malware family is named.
• 2026-07-30 CloudSEK analyzes locked-ioc-7, a signed packed PE that queries locked-ioc-23 and fetches locked-ioc-28 from locked-ioc-4 (locked-ioc-17); about 31 lookalike domains listed as hosting the same fake notice.
• 2026-07-30 CloudSEK documents the WhatsApp penalty-notice lure (TAX/PEN/2026-142, Sections 271(1)(c) and 276C, 72-hour deadline) delivering locked-ioc-27 with an Android APK at rotating sizes of 2, 34 and 35 MB.
• 2026-07-30 CloudSEK publishes 'Tax Season, Open Season' describing sustained campaigns impersonating the Indian Income Tax Department (WhatsApp locked-ioc-27 lure, fake refund messages, cloned e-Filing portals, fake e-PAN, fraudulent tax agents).

Sources cited

• An Income Tax Assessment Notice Phishing Campaign Delivering Malware (CYFIRMA, related campaign) cyfirma.com · Research · 2026-06-23
• An Income Tax Assessment Notice Phishing Campaign Delivering Malware (Gurucul) community.gurucul.com · Research · 2026-06-24
• Indian income tax-themed phishing campaign targets local businesses (Gurucul summary of Seqrite research) gurucul.com · Research
• Tax Season, Open Season: Phishing and Malware Campaigns Targeting Indian Taxpayers cloudsek.com · Blog · 2026-07-30
• Indian Tax Phishing Campaign Delivers Persistent RAT Malware (eSecurityPlanet, related Seqrite-sourced campaign) esecurityplanet.com · News · 2025-12-23
• Fake Income Tax Emails Target Indian Users as Kaspersky Warns of SilverFox Cyberattack Campaign angelone.in · News
• Fake Income Tax Notices Uncovered On WhatsApp fintechbiznews.com · News

More in phishing

• Microsoft Teams Booking-Flow Device Code Phishing Campaign Targeting Microsoft 365 Accounts
• Microsoft Teams Booking-Flow Lure Used for Device Code Phishing Against Construction Sector
• AWS Login Phishing: Abuse of `aws login --remote` Cross-Device Authentication Flow (Mitiga PoC)
• Lookalike Microsoft Teams domains delivered via search ads, AI search answers and SEO poisoning (no phishing email)
• 2026 FIFA World Cup Scam Wave: 35,000+ Fake Ticket, Shop and Streaming Sites