Loading story…
Threat researchers reported an espionage-focused phishing operation dubbed SyncFuture targeting individuals in India by impersonating the country’s Income Tax Department. Victims were lured with urgent “tax penalty/compliance” notices (including distribution via SendGrid in some cases) that delivered a ZIP archive masquerading as a government document review tool; opening it launched a multi-stage infection chain designed to establish long-term access. Analysis attributed the discovery to eSentire’s Threat Response Unit, which documented the use of DLL side-loading with legitimate Microsoft-signed applications, privilege escalation via a COM-based UAC bypass, and process masquerading (e.g., appearing as explorer.exe) to reduce detection.
The campaign also demonstrated notable defense evasion by abusing trusted software and user interaction: it leveraged Microsoft-signed binaries and ultimately deployed a legitimate enterprise management/security platform repurposed as the final payload for persistent remote control and surveillance, described as a commercial-grade Chinese IT management tool used for spying. Researchers also observed an unusual technique to evade Avast Free Antivirus by simulating mouse movements and clicks to navigate the product UI and disable/evade protections, underscoring a “living off trusted tools” approach rather than relying solely on custom malware components.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
In January 2026, eSentire’s Threat Response Unit disclosed the campaign, naming it 'SyncFuture' and detailing its multi-stage infection chain, use of legitimate signed binaries, and long-term surveillance objectives. Researchers said the activity had not been attributed to a known threat actor, though some reporting described it as China-linked.
Analysis of the malware revealed a tailored evasion technique against Avast Free Antivirus, using simulated mouse movements and clicks to add malicious files to the product’s exclusion list. This indicated attacker testing and customization against specific defensive software.
The intrusion chain used DLL sideloading, anti-analysis checks, a COM-based UAC bypass, and process masquerading before delivering a Blackmoon variant and the legitimate Chinese SyncFuture Terminal Security Management System as a surveillance platform. The final tooling enabled persistence, remote control, screen recording, file tracking, and data exfiltration.
In early December 2025, attackers launched a phishing campaign impersonating India’s Income Tax Department, using tax penalty lures and malicious ZIP archives to target users in India. The operation was assessed as espionage-focused rather than financially motivated.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcescworld.com
Open sourcethehackernews.com
Open sourcecybersecuritynews.com
Open sourcesecurityonline.info
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that the **TAX#TRIDENT** campaign is targeting Windows users in India with fake Income Tax assessment notices that lure victims into downloading malicious files. The operation relies on social engineering rather than software exploits and uses multiple delivery chains, including ZIP archives, VBScript downloaders, and a `.php` endpoint that actually serves VBScript. Across the campaign, attackers rotate domains, decoy documents, and payload delivery paths while keeping the same tax-themed lure, reducing the effectiveness of static blocklists and signature-based defenses. Two infection chains deliver a signed `ClientSetup` payload linked to **SyncFuture/Yangtu/YTSCRat-style** tooling, creating a hidden `msres` directory, installing the `MANC` service and `YtMiniFilter`/`ytdisk` drivers, writing `YTSysConfig` data, and launching a fake `svchost.exe` that maintains communications over ports `6671`, `6681`, and `6683`. A third chain abuses a legitimate **ManageEngine UEMS** agent, staging files in Public Documents, disguising copied LOLBins as DLLs, lowering UAC prompt behavior, silently installing `UEMSAgent.msi`, and enrolling infected hosts to attacker-controlled infrastructure at `202.61.160.201` over ports `8383` and `8027`. Researchers said the tooling reflects abuse of China-linked commercial software but did not attribute the campaign to a specific threat actor, and urged defenders to prioritize behavioral indicators such as unusual `svchost.exe` paths, hidden system-folder directories, script engines executing web-style files, suspicious outbound ports, and unauthorized UAC policy changes.
Jun 29, 2026
Multiple reports highlight active campaigns using *phishing* and *software supply-chain abuse* to steal credentials and establish persistence. eSentire described an espionage-focused operation targeting residents of India with emails impersonating the Income Tax Department, leading victims to a malicious archive that uses DLL side-loading with a legitimate signed Microsoft application, extensive anti-analysis checks, in-memory shellcode unpacking, UAC bypass, and process masquerading; the payload was identified as a **Blackmoon**-family variant that specifically attempts to disable **Avast Free Antivirus** by automating UI interactions to add exclusions. Separately, Aikido reported a malicious npm package (`ansi-universal-ui`) that deploys a multi-stage infostealer (“**G_Wagon**”) by abusing `postinstall` execution, downloading a Python runtime, running an obfuscated payload, and exfiltrating browser credentials, cloud credentials, Discord tokens, and data from 100+ cryptocurrency wallets to an Appwrite storage bucket; it also includes a Windows DLL used for browser-process injection via NT native APIs. In parallel, network-edge exploitation remains a key access vector: Risky Business reported a renewed wave of attacks against **Fortinet FortiGate** devices via a vulnerability Fortinet allegedly “patched” in December but which attackers can still exploit, enabling SSO authentication bypass (via crafted SAML), creation of new admin accounts, and theft of device configuration; mitigations include disabling the FortiCloud SSO feature (not enabled by default). Several other items are general awareness or roundup content rather than specific incident reporting: TechTarget and other blogs emphasized ongoing phishing/email risk (including relay spam abusing legitimate Zendesk instances) and password hygiene, while The Hacker News published a multi-story bulletin that includes (among other items) a spear-phishing campaign in Afghanistan delivering a FALSECUB backdoor via a GitHub-hosted ISO and LNK execution chain; Risky Business also covered Iran’s internet blackout and Starlink jamming/spoofing as a communications-control issue rather than an enterprise cyber incident.
Jun 29, 2026
Security researchers reported active phishing activity targeting enterprise users by impersonating routine workplace workflows (e.g., meeting invites, invoices, and document notifications) to trick recipients into running malware. One campaign used executables masquerading as *Microsoft Teams*, *Zoom*, and *Adobe Acrobat Reader* installers (e.g., `msteams.exe`, `zoomworkspace.clientsetup.exe`, `adobereader.exe`, `invite.exe`) that appeared trustworthy because they were **digitally signed** with an Extended Validation (EV) certificate issued to **TrustConnect Software PTY LTD**. Microsoft Defender telemetry attributed the activity to an unknown threat actor and assessed the approach as a deliberate, multi-wave effort designed to bypass user suspicion and basic security controls. After execution, the signed malware deployed **remote monitoring and management (RMM)** tooling—reported examples include **ScreenConnect**, **Tactical RMM**, and **Mesh Agent**—to establish persistent remote access and enable follow-on actions across affected environments. Separately, reporting also highlighted phishing lures distributing **malicious ISO attachments** embedded in job application/resumé-themed emails, reinforcing that attackers continue to rely on socially engineered business processes (recruiting and HR workflows in particular) to deliver initial payloads and gain a foothold.
Jun 29, 2026