Indian Income Tax-Themed Attacking Businesses with a Multi-Stage Infection Chain
## Cybersecurity: Phishing Campaign Targeting Indian Businesses
Cybersecurity: Phishing Campaign Targeting Indian Businesses
Cybercriminals have increasingly exploited the Income Tax Return (ITR) filing season to launch sophisticated phishing campaigns directed at Indian businesses. By leveraging public anxiety regarding tax compliance and refund timelines, attackers have crafted deceptive schemes that mimic official government communications.
The latest attacks employ a multi-stage infection chain, beginning with a spear-phishing email and culminating in the deployment of persistent malware capable of full system compromise.
The attack initiates with an email subject tagged "Tax Compliance Review Notice," allegedly from the Income Tax Department. Close examination reveals the sender uses a suspicious Outlook[.]com address rather than an official government domain. The email body lacks text, featuring only an embedded image indistinguishable from a genuine notice, bypassing standard text-based spam filters. This tactic creates a false sense of urgency by citing fabricated deadlines and compliance issues.
The attack initiates with an email subject tagged "Tax Compliance Review Notice," allegedly from the Income Tax Department.
Recipients are prompted to open an attachment named "Review Annexure.pdf," resembling a legitimate tax document. This PDF includes a malicious link directing users to a fraudulent compliance portal. Seqrite analysts identified that the portal triggers the download of a ZIP archive while instructing users to disable their antivirus software under the guise of "compatibility issues."
The campaign's technical sophistication emerges when victims engage with the downloaded payload. The infection process uses a two-stage NSIS installer that unpacks multiple files to establish a foothold on the victim's machine. The malware installs a persistent service named NSecRTS.exe to ensure it runs automatically in the background. This service communicates with Command and Control (C2) servers over non-standard ports, such as 48991 and 48992.
Researchers noted that technical indicators, including Simplified Chinese language usage and specific code-signing certificates, suggest the tooling originated from a China-linked development environment. This transformation from a simple phishing email to a fully operational Remote Access Trojan (RAT) underscores the critical need for vigilance against multi-stage threats.
Based on reporting by Cyber Security News.