# Tax-Season Phishing and Malware Campaigns Impersonating India's Income Tax Department Targeting Indian Taxpayers (ITD.zip / ITD_Tax_Notice.exe)

> CloudSEK reports sustained 2026 campaigns impersonating India's Income Tax Department through fake penalty notices (largely WhatsApp-delivered), refund lures, cloned e-Filing portals, fake e-PAN files and fraudulent tax agents. A 'Download Documents' lure delivers ITD.zip containing an Android APK or a signed Windows executable (ITD_Tax_Notice.exe) that fetches a second-stage 88.bin from an Alibaba Cloud OSS bucket.

- **Published:** 2026-11-12T12:35:03Z
- **Last reviewed:** 2026-11-12T12:35:03Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5858
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5858.png
- **ID:** TL-2026-5858
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 28 (3 shown free below)

## Description

CloudSEK (2026-07-30) documents multiple overlapping tax-season campaigns aimed at Indian taxpayers during and just after the 2026 ITR filing window. The WhatsApp lure is a forged Income Tax Department Office Memorandum (fake file number TAX/PEN/2026-142, spoofed signatory 'Raj Kumar Sharma, Assistant Commissioner of Income Tax', citations of Sections 271(1)(c) and 276C of the Income Tax Act 1961, a 72-hour deadline, bilingual Hindi/English text) sent from unknown or compromised accounts with no tax-related identity, with a ZIP named ITD.zip. The ZIP contains an Android APK; the archive was observed at rotating sizes (2 MB, 34 MB, 35 MB), indicating payload rotation. The APK is described as requesting broad permissions, reading/intercepting SMS (including bank OTPs), harvesting contacts to spread itself, capturing keystrokes and overlaying fake screens on banking and payment apps.

A second lure uses newly registered lookalike domains (about 31 listed in the source, e.g. apeal.lol, laoshunfa.xyz, gov-xnui.com, indiaaba.com) hosting the same forged notice with a 'Download Documents' button that delivers Windows malware instead of documents. The sample ITD_Tax_Notice.exe is a 3,265,096-byte PE32 GUI executable (SHA-256 667b37eafb9ec5131ed4f017ed429a47dca3adf626b2fc85fc6424b1e17ff6e1) with version metadata masquerading as svchost.exe ('Service Host', 'Microsoft Windows', company 'Windows Software Development Team'), near-8.0 entropy and a writeable .text section suggesting in-memory unpacking, and a valid EV code-signing certificate from Certum Extended Validation Code Signing 2021 CA issued to a Chinese sole proprietor in Linyi, Shandong (serial 2D85A7A16D1EB86DFD92B00F6267733D) that does not match a Microsoft binary.

At runtime the small packed first stage queries the legitimate geolocation service ipwho.is, then fetches 88.bin from https://vss2.oss-cn-hongkong.aliyuncs.com/ (Alibaba Cloud OSS, Hong Kong; resolves to 47.79.66.58). The second stage is assessed as likely shellcode or an encrypted blob run in memory. CloudSEK observed modified sleep behaviour and virtualization checks followed by registry, security-software and system-information reconnaissance, after which the process exits into Windows Error Reporting. Only two endpoints were observed (Alibaba Cloud and ipwho.is), both legitimate services. CloudSEK links the web-lure flow to RAT/infostealer delivery in 2026 income-tax campaigns, with sideloading of a signed binary from an archive or disk image, but names no malware family and no threat actor; the RAT/infostealer characterization of the Windows payload is the vendor's assessment, not a confirmed family identification.

The wider ecosystem includes refund SMS/email fraud, cloned e-Filing portals harvesting PAN, Aadhaar, passwords, OTPs and bank details, fake e-PAN files, and fraudulent tax consultants. Independent reporting describes related but distinct income-tax-themed campaigns (Seqrite/eSecurityPlanet, December 2025: image-only emails, 'Review Annexure.pdf', fake ITD Compliance Portal, NSIS-based installer and persistent RAT; CyFirma, June 2026: Tax_Assessment.exe, XWorm-like .NET RAT). These are not shown to share infrastructure with the CloudSEK campaign and should not be treated as the same cluster without further evidence. No BeaconBeagle correlation could be obtained (API returned HTTP 502).

## MITRE ATT&CK

- T1566.002 Spearphishing Link
- T1204.002 Malicious File
- T1583.001 Domains
- T1608.001 Upload Malware
- T1497 Virtualization/Sandbox Evasion
- T1574.001 DLL
- T1055 Process Injection
- T1027.002 Software Packing
- T1036.005 Match Legitimate Resource Name or Location
- T1553.002 Code Signing
- T1012 Query Registry
- T1518.001 Security Software Discovery
- T1082 System Information Discovery
- T1071 Application Layer Protocol
- T1095 Non-Application Layer Protocol
- T1573 Encrypted Channel

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**ITD_Tax_Notice.exe Loader Execution (Fake Income Tax Dept Notice) - Exploitation** (`TL-2026-5858-SPL-001`)

Detects execution of the ITD_Tax_Notice.exe first-stage loader delivered by the 'Download Documents' lure in the 2026 Indian Income Tax Department impersonation campaign (TL-2026-5858). Matches the known file name, SHA256/SHA1/MD5/imphash from the CloudSEK report, and the svchost-lookalike version info ('Service Host' / 'Windows Software Development Team') carried by the packed, EV-signed PE. Flags whether the binary ran from a user-writable path.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1204.002, T1036.005, T1027.002
- **Data sources:** sysmon, index=sysmon sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational (EventCode 1), Microsoft Defender for Endpoint DeviceProcessEvents
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (Image="*ITD_Tax_Notice.exe" OR Hashes="*667B37EAFB9EC5131ED4F017ED429A47DCA3ADF626B2FC85FC6424B1E17FF6E1*" OR Hashes="*DFF2B7A23882445B4E354199BF38554F*" OR Hashes="*7479FBC27320AE246DB9030CCA80809EC63DE0E9*" OR Hashes="*538AD8E0AD1FEC0ECC54F9E120AC6FF9*" OR (Company="Windows Software Development Team" Description="Service Host"))
| eval detection_reason=case(match(Image,"(?i)ITD_Tax_Notice[.]exe$"),"known_filename",match(Hashes,"(?i)(667B37EAFB9EC513|DFF2B7A23882445B|7479FBC27320AE24|538AD8E0AD1FEC0E)"),"known_hash",true(),"svchost_lookalike_version_info")
| eval user_writable_path=if(match(Image,"(?i)^[a-z]:.(Users.+.(Downloads|AppData|Desktop|Temp)|Users.Public|ProgramData|Windows.Temp)."),"yes","no")
| fillnull value="unknown" User ParentImage CommandLine
| stats count min(_time) as first_seen max(_time) as last_seen values(detection_reason) as detection_reason values(Hashes) as Hashes values(CommandLine) as CommandLine by host User Image ParentImage user_writable_path
| convert ctime(first_seen) ctime(last_seen)
| table first_seen last_seen host User Image ParentImage CommandLine Hashes detection_reason user_writable_path count
```

### Microsoft KQL

```kql
let itd_hashes = dynamic(["667b37eafb9ec5131ed4f017ed429a47dca3adf626b2fc85fc6424b1e17ff6e1","7479fbc27320ae246db9030cca80809ec63de0e9","dff2b7a23882445b4e354199bf38554f"]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "ITD_Tax_Notice.exe" or SHA256 in~ (itd_hashes) or SHA1 in~ (itd_hashes) or MD5 in~ (itd_hashes) or (ProcessVersionInfoCompanyName =~ "Windows Software Development Team" and ProcessVersionInfoFileDescription =~ "Service Host")
| extend InUserWritablePath = FolderPath has_any ("Downloads","AppData","Temp","Public","Desktop","ProgramData")
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, ProcessVersionInfoCompanyName, ProcessVersionInfoFileDescription, SHA256, InUserWritablePath, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc
```

### Sigma

```yaml
title: ITD_Tax_Notice.exe Execution Impersonating Indian Income Tax Department Lure
id: a1f3c8e2-4b97-4d6a-8c15-7e29b0d3f501
status: experimental
description: Detects execution of the ITD_Tax_Notice.exe first-stage loader by known file name, SHA256/SHA1/MD5/imphash, or version info masquerading as svchost.exe (Service Host / Windows Software Development Team), as reported by CloudSEK for the 2026 Indian tax-season campaign.
references:
    - https://www.cloudsek.com/blog/tax-season-open-season-phishing-and-malware-campaigns-targeting-indian-taxpayers
author: Threadlinqs Team
date: 2026/11/12
tags:
    - attack.execution
    - attack.t1204.002
    - attack.defense-evasion
    - attack.t1036.005
    - attack.t1027.002
logsource:
    category: process_creation
    product: windows
detection:
    selection_name:
        Image|endswith: '\ITD_Tax_Notice.exe'
    selection_hash:
        Hashes|contains:
            - 'SHA256=667B37EAFB9EC5131ED4F017ED429A47DCA3ADF626B2FC85FC6424B1E17FF6E1'
            - 'SHA1=7479FBC27320AE246DB9030CCA80809EC63DE0E9'
            - 'MD5=DFF2B7A23882445B4E354199BF38554F'
            - 'IMPHASH=538AD8E0AD1FEC0ECC54F9E120AC6FF9'
    selection_versioninfo:
        Company: 'Windows Software Development Team'
        Description: 'Service Host'
    condition: 1 of selection_*
falsepositives:
    - Internal tooling that reuses the same version-info strings
level: high
```

**Known false positives:**

- Legitimate internal software that happens to ship with the same 'Service Host' / 'Windows Software Development Team' version strings
- Security teams detonating the sample in a lab or sandbox that forwards Sysmon logs

**Tuning notes:** Exclude known malware-analysis hosts by host/index. The hash and filename branches are high fidelity but will not survive payload rotation; keep the version-info and user-writable-path branches. Update hash lists as new ITD_Tax_Notice.exe builds are published.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- [indicator] / [indicator] Dropped to Disk from Fake Tax Notice Lure - Exploitation (locked: unlock with TL Creds)
- svchost.exe Masquerade Outside System Directories / Certum EV Signing Cert Serial - Post-Exploitation (locked: unlock with TL Creds)
- [indicator] Geolocation Lookup by Non-Browser Process - C2/Victim Profiling (locked: unlock with TL Creds)
- DNS Resolution of Income Tax Department Lookalike Lure Domains - Exploitation (locked: unlock with TL Creds)
- Unsigned DLL Loaded Beside Process in User-Writable Folder (Side-Loading) - Post-Exploitation (locked: unlock with TL Creds)
- Non-Browser Process in User-Writable Path Contacting Alibaba Cloud OSS (aliyuncs.com) - C2/Staging (locked: unlock with TL Creds)
- Sandbox, Security-Software and System Recon Burst from User-Writable Process - Post-Exploitation (locked: unlock with TL Creds)
- Second-Stage [indicator] Staging Contact to Alibaba OSS [indicator] - C2/Staging (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 28)

Defanged, TLP:CLEAR.

- IP address: `47.79.66[.]58`
- Domain: `vss2[.]oss-cn-hongkong[.]aliyuncs[.]com`
- File hash: `667b37eafb9ec5131ed4f017ed429a47dca3adf626b2fc85fc6424b1e17ff6e1`

Full set of 28 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Tax Season, Open Season: Phishing and Malware Campaigns Targeting Indian Taxpayers](https://www.cloudsek.com/blog/tax-season-open-season-phishing-and-malware-campaigns-targeting-indian-taxpayers)
- [Indian Tax Phishing Campaign Delivers Persistent RAT Malware (eSecurityPlanet, related Seqrite-sourced campaign)](https://www.esecurityplanet.com/threats/indian-tax-phishing-campaign-delivers-persistent-rat-malware/)
- [An Income Tax Assessment Notice Phishing Campaign Delivering Malware (CYFIRMA, related campaign)](https://www.cyfirma.com/research/an-income-tax-assessment-notice-phishing-campaign-delivering-malware/)
- [An Income Tax Assessment Notice Phishing Campaign Delivering Malware (Gurucul)](https://community.gurucul.com/articles/ThreatResearch/An-Income-Tax-Assessment-Notice-24-6-2026)
- [Indian income tax-themed phishing campaign targets local businesses (Gurucul summary of Seqrite research)](https://gurucul.com/latest-threats/indian-income-tax-themed-phishing-campaign-targets-local-businesses/)
- [Fake Income Tax Emails Target Indian Users as Kaspersky Warns of SilverFox Cyberattack Campaign](https://www.angelone.in/news/personal-finance/fake-income-tax-emails-target-indian-users-as-kaspersky-warns-of-silverfox-cyberattack-campaign)
- [Fake Income Tax Notices Uncovered On WhatsApp](https://fintechbiznews.com/fintech-it-security/fake-income-tax-notices-uncovered-on-whatsapp-)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5858