A phishing campaign in India delivers remote access malware via fake income tax assessment notices, using convincing government branding to trick victims into downloading a malicious ZIP archive. The archive contains a loader and a disguised DLL that uses reflection-based techniques to evade detection, establishing encrypted C2 communication with servers in Hong Kong. Defenses include deploying updated antivirus with behavioral detection and verifying all tax correspondence directly through official government channels, avoiding any embedded links or file executions from unsolicited archives.
Malware Fake tax notices used to deliver remote access malware in India June 29, 2026 Share By SC Staff A new phishing campaign is using fake income tax assessment notices to deliver dangerous malware to unsuspecting victims across India, according to a recent report by Tech Radar. Attackers are employing sophisticated tactics, hiding malicious code behind convincing government branding and legal references to trick victims into downloading a ZIP archive, according to CYFIRMA. This archive contains a disk image file with a loader program that, in turn, triggers a disguised DLL file. The malware uses reflection-based techniques to evade detection and establishes encrypted communication with servers located in Hong Kong. This operation closely resembles known commodity RAT families, suggesting a financially motivated goal. The same loader-and-payload architecture has previously been linked to ransomware operators, indicating the potential for varied attack types. Defenses include up-to-date antivirus software with behavioral detection and verifying tax-related correspondence directly through official government channels, avoiding embedded links or unknown file executions from archives or disk images. Source: Tech Radar SC Staff Related Malware New SharkLoader malware campaign deploys Cobalt Strike Beacon SC Staff June 29, 2026 The StrikeShark campaign exhibits a broad geographic reach, targeting a diplomatic organization in Indonesia, government entities in Taiwan, software development companies globally, and other sectors in Hong Kong, Lebanon, Syria, Colombia, North Macedonia, Nepal, and Serbia. Malware Grand Theft Auto VI hype fuels new wave of scams targeting gamers SC Staff June 26, 2026 Security firms Malwarebytes and NordVPN have identified a surge of sophisticated fake websites offering "VIP Early Access" to Grand Theft Auto VI. Malware New ‘Edgecution’ malware uses browser extension to deploy ransomware SC Staff June 25, 2026 The Edgecution malware exploits the Chrome Native Messaging protocol to enable communication between browser extensions and native desktop applications. Get daily email updates SC Media's daily must-read of the most current and pressing daily news Business Email By clicking the Subscribe button below, you agree to SC Media Terms of Use and Privacy Policy . Subscribe Related Terms Adware You can skip this ad in 5 seconds