Loading story…
Attackers are impersonating India’s Income Tax Department in a phishing campaign that lures users to the fraudulent domain harivo[.]vip and prompts them to download a fake tax assessment archive. Researchers said the ZIP file leads to a staged infection chain involving a disk image and a .NET loader, ultimately executing Tax_Assessment.exe and libsvcs.dll to install a RAT-like payload on Windows systems while abusing trusted government branding to increase credibility.
The malware uses ConfuserEx obfuscation, reflection-based DLL loading, and other defense-evasion techniques, and its behavior reportedly aligns closely with XWorm. Once launched, it establishes persistence, performs system reconnaissance and user monitoring, enables remote command execution, and communicates with a hardcoded command-and-control server at 103.231.12.27:4444 over encrypted channels, giving the threat actor sustained remote access; the infrastructure has been linked to a domain reportedly registered in September 2025, and researchers assess the operation as likely financially motivated.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
The phishing infrastructure used in the fake Income Tax Department campaign included the domain harivo[.]vip, which the reporting says was registered in September 2025.
Cyfirma identified a phishing and malware campaign targeting users in India by impersonating the Income Tax Department with fake assessment notices hosted on harivo[.]vip. The infection chain reportedly delivered a RAT-like payload using a ZIP archive, disk image, and obfuscated .NET loader that communicated with 103.231.12.27:4444.
Seqrite reported that Operation DragonReturn, a spear-phishing campaign impersonating India’s Income Tax Department, was first observed on 2026-05-18 and assessed with medium-to-high confidence to be linked to a China-aligned threat cluster based on infrastructure overlaps, Chinese-language artifacts, and TTP similarities with Silver Fox.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
seqrite.com
Open sourcecybersecuritynews.com
Open sourcecommunity.gurucul.com
Open sourcecyfirma.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported a suspected China-linked phishing campaign targeting Indian taxpayers, tax professionals, and corporate finance teams by impersonating the **Income Tax Department of India**. The operation, tracked as **Operation DragonReturn**, used tax-themed emails to lure victims into opening malicious archives and virtual disk files that triggered multi-stage infections through **DLL side-loading** and hijacking. Observed activity began in mid-May, and investigators said the infrastructure and tradecraft show overlaps with the China-associated group **Silver Fox**. The malware chains ultimately deployed remote access trojans including **DCRat** and **ValleyRat**, along with secondary payloads for screenshots and data exfiltration. Researchers said the intrusions relied on anti-analysis checks, **UAC** elevation, image-based payload concealment, encrypted in-memory execution, **AMSI** bypass, process injection, and persistence via Windows services and the registry. The implants were also capable of downloading additional encrypted modules from command-and-control servers, giving attackers covert, persistent access to victim systems.
Jul 8, 2026
A China-nexus espionage campaign dubbed **Operation DragonReturn** has targeted India’s tax ecosystem by impersonating the Income Tax Department and distributing a fake filing utility during the `AY2026-27` tax season. Researchers said the operation used a lure hosted at `govtop[.]one/incometax` to deliver a ZIP archive posing as `Common_Offline_Utility_ITR-1_to_4_AY2026-27.zip`, aiming at taxpayers, tax professionals, corporate finance teams, and government-linked tax infrastructure. Seqrite and Gurucul assessed the activity with medium-to-high confidence as aligned with a China-linked cluster based on infrastructure overlaps, Chinese-language artifacts, and tradecraft similarities to RAT-focused espionage operations active across Asia. The infection chain deployed **DcRAT** through multiple stages, using image-based payload concealment in `background.jpg`, process injection into `svchost.exe`, AMSI bypass, and fileless execution of a decrypted .NET assembly in memory. Persistence was established through a Windows service named **MixedSvc** masquerading as “Windows Mixed Reality Service,” while command-and-control traffic was observed over encrypted TLS to `223.26.63.40:2671`, with related infrastructure tied to `kkxqbh[.]top`, `1kkkkddd.com`, and additional domains, IPs, and SHA-256 indicators published by Gurucul. Researchers said the operators rotated payloads every 7–10 days, and at least one variant initially showed `0/66` detections on VirusTotal, underscoring the campaign’s emphasis on stealth and intelligence collection.
Jun 29, 2026
Researchers reported that the **TAX#TRIDENT** campaign is targeting Windows users in India with fake Income Tax assessment notices that lure victims into downloading malicious files. The operation relies on social engineering rather than software exploits and uses multiple delivery chains, including ZIP archives, VBScript downloaders, and a `.php` endpoint that actually serves VBScript. Across the campaign, attackers rotate domains, decoy documents, and payload delivery paths while keeping the same tax-themed lure, reducing the effectiveness of static blocklists and signature-based defenses. Two infection chains deliver a signed `ClientSetup` payload linked to **SyncFuture/Yangtu/YTSCRat-style** tooling, creating a hidden `msres` directory, installing the `MANC` service and `YtMiniFilter`/`ytdisk` drivers, writing `YTSysConfig` data, and launching a fake `svchost.exe` that maintains communications over ports `6671`, `6681`, and `6683`. A third chain abuses a legitimate **ManageEngine UEMS** agent, staging files in Public Documents, disguising copied LOLBins as DLLs, lowering UAC prompt behavior, silently installing `UEMSAgent.msi`, and enrolling infected hosts to attacker-controlled infrastructure at `202.61.160.201` over ports `8383` and `8027`. Researchers said the tooling reflects abuse of China-linked commercial software but did not attribute the campaign to a specific threat actor, and urged defenders to prioritize behavioral indicators such as unusual `svchost.exe` paths, hidden system-folder directories, script engines executing web-style files, suspicious outbound ports, and unauthorized UAC policy changes.
Jun 29, 2026