Fake Indian Tax Notice Campaign Delivers XWorm-Like RAT

Attackers are impersonating India’s Income Tax Department in a phishing campaign that lures users to the fraudulent domain harivo[.]vip and prompts them to download a fake tax assessment archive. Researchers said the ZIP file leads to a staged infection chain involving a disk image and a .NET loader, ultimately executing Tax_Assessment.exe and libsvcs.dll to install a RAT-like payload on Windows systems while abusing trusted government branding to increase credibility.

The malware uses ConfuserEx obfuscation, reflection-based DLL loading, and other defense-evasion techniques, and its behavior reportedly aligns closely with XWorm. Once launched, it establishes persistence, performs system reconnaissance and user monitoring, enables remote command execution, and communicates with a hardcoded command-and-control server at 103.231.12.27:4444 over encrypted channels, giving the threat actor sustained remote access; the infrastructure has been linked to a domain reportedly registered in September 2025, and researchers assess the operation as likely financially motivated.