Tax-Themed Phishing Campaigns Target Indian Taxpayers With Malware and Credential Theft

Jul 30, 2026 · Original article ↗

Summary

CloudSek analyzes tax-themed scams targeting Indian taxpayers, including WhatsApp-delivered malware and fake tax portals. The report details a Windows loader, its cloud-hosted second stage, campaign indicators, and steps to avoid or respond to infection.

Key points

WhatsApp messages impersonate the Income Tax Department with fake penalty notices and malicious ZIP attachments; the article says the department does not serve statutory notices over WhatsApp.
A separate set of lookalike tax websites uses fake notices and download buttons to deliver malware from disposable domains.
A Windows executable named ITD_Tax_Notice.exe masquerades as svchost.exe, uses packing and sandbox-evasion checks, and retrieves a second-stage payload from Alibaba Cloud storage.
The observed malware profiles victims and conducts system and security-software reconnaissance; the analysis lists file hashes, network indicators, and ATT&CK techniques.
Related scams use refund messages, cloned e-Filing pages, fake e-PAN files, and fraudulent refund agents to steal credentials, OTPs, and financial details.
The article advises taxpayers to avoid unexpected attachments and links, verify notices through the official portal, and change credentials from a clean device if a suspicious file was opened.

Article Details

Attack Vectors: WhatsApp and other messaging apps deliver a fake Income Tax Department penalty notice with an ITD.zip attachment containing a malicious Android application or Windows executable.
Lookalike tax-notice pages lure visitors to download malware through a “Download Documents” button; the article reports that the specific domains rotate.
The Windows payload fetches a second-stage binary from a cloud-hosted URL.
Refund-themed SMS, email, and WhatsApp messages link to credential-harvesting pages requesting PAN, login credentials, OTPs, and bank details.
Cloned e-Filing portals harvest submitted identity and financial information.
Fake e-PAN messages and refund-agent scams use unexpected attachments, requests for verification, or offers of guaranteed refunds to harvest information or money.
Defensive Notes: Do not open tax-notice attachments or tap download buttons received through WhatsApp, SMS, or other messaging apps; verify notices by independently visiting the official e-Filing portal.
Never provide passwords, OTPs, or full bank details in response to an inbound message.
If an ITD.zip or similar file has been opened, treat the device as compromised: disconnect it from the network, change passwords from a clean device, enable multi-factor authentication, and run a full malware scan.
For organizations, consider blocking newly registered and low-trust TLDs at the gateway and reviewing inbound archives and disk-image files.
Watch for unusual svchost.exe paths, hidden system-folder directories, script engines running web-style files, and unexpected outbound connections.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`22[.]laoshunfa[.]xyz`	Hosts the fake tax notice and malware-delivery flow.
DOMAIN	`apeal[.]lol`	Hosts a fake tax notice whose download button delivers malware.
DOMAIN	`audet[.]club`	Hosts the fake tax notice and malware-delivery flow.
DOMAIN	`bcgovtop[.]lol`	Hosts the fake tax notice and malware-delivery flow.
DOMAIN	`ckoming[.]study`	Hosts the fake tax notice and malware-delivery flow.
DOMAIN	`clerk[.]lat`	Hosts the fake tax notice and malware-delivery flow.
DOMAIN	`fsyahsxd[.]xin`	Hosts the fake tax notice and malware-delivery flow.
DOMAIN	`gisudyawz[.]ink`	Hosts the fake tax notice and malware-delivery flow.
DOMAIN	`gov-xnui[.]com`	Hosts the fake tax notice and malware-delivery flow.
DOMAIN	`gova[.]bar`	Hosts the fake tax notice and malware-delivery flow.
DOMAIN	`govtocki[.]shop`	Hosts the fake tax notice and malware-delivery flow.
DOMAIN	`indiaaba[.]com`	Hosts the fake tax notice and malware-delivery flow.
DOMAIN	`ingovtop[.]click`	Hosts the fake tax notice and malware-delivery flow.
DOMAIN	`kcsueaw[.]xin`	Hosts the fake tax notice and malware-delivery flow.
DOMAIN	`konimqh[.]study`	Hosts the fake tax notice and malware-delivery flow.
DOMAIN	`laiuatexqw[.]cc`	Hosts the fake tax notice and malware-delivery flow.
DOMAIN	`laoshunfa[.]xyz`	Hosts the fake tax notice and malware-delivery flow.
DOMAIN	`lzaiwugsa[.]ink`	Hosts the fake tax notice and malware-delivery flow.
DOMAIN	`oder[.]autos`	Hosts the fake tax notice and malware-delivery flow.
DOMAIN	`qaksdiuw[.]xin`	Hosts the fake tax notice and malware-delivery flow.
DOMAIN	`sfinmgov[.]club`	Hosts the fake tax notice and malware-delivery flow.
DOMAIN	`tarif[.]lol`	Hosts the fake tax notice and malware-delivery flow.
DOMAIN	`tzawccsw[.]xin`	Hosts the fake tax notice and malware-delivery flow.
DOMAIN	`xcvgyuraw[.]live`	Hosts the fake tax notice and malware-delivery flow.
DOMAIN	`zasudtytw[.]xin`	Hosts the fake tax notice and malware-delivery flow.
DOMAIN	`zixhasda[.]xin`	Hosts the fake tax notice and malware-delivery flow.
DOMAIN	`zuytyarws[.]xin`	Hosts the fake tax notice and malware-delivery flow.
DOMAIN	`zxizusuy[.]xin`	Hosts the fake tax notice and malware-delivery flow.
DOMAIN	`zytsyxbwa[.]live`	Hosts the fake tax notice and malware-delivery flow.
MD5	`dff2b7a23882445b4e354199bf38554f`	MD5 hash of the malicious ITD_Tax_Notice.exe sample.
SHA1	`7479fbc27320ae246db9030cca80809ec63de0e9`	SHA-1 hash of the malicious ITD_Tax_Notice.exe sample.
SHA256	`667b37eafb9ec5131ed4f017ed429a47dca3adf626b2fc85fc6424b1e17ff6e1`	SHA-256 hash of the malicious ITD_Tax_Notice.exe sample.
URL	`hxxps[:]//vss2[.]oss-cn-hongkong[.]aliyuncs[.]com/88[.]bin`	Cloud-hosted second-stage payload URL fetched by the Windows malware.