“Tax Compliance” Trap: Hackers Mimic Indian Income Tax Department to Deploy China-Linked Malware

A new, multi-stage phishing campaign targeting Indian businesses has been analysed by SEQRITE Labs’ APT Team, using a fake tax notice to exploit fears of non-compliance. The attack begins with a spear-phishing email that appears to come from the Office of the Deputy Assistant Director of Income Tax, Investigation, with the subject “Tax Compliance Review Notice,” and uses an embedded image to bypass text-based security scanners.

Victims are directed to Review Annexure.pdf, which links to a fraudulent compliance portal that downloads a malicious ZIP file; the portal instructs victims to turn off their security software. The infection chain establishes persistence through a two-stage installer, the Stage-1 loader carrying a digital signature from Hengshui Shenwei Technology Co., Ltd., and the Stage-2 installer signed by Shandong Anzai Information Technology CO., Ltd., with a GUI in Simplified Chinese indicating a China-linked origin.

Once active, the malware acts as a RAT, harvesting system data and communicating with multiple C2 servers, effectively turning routine compliance checks into a gateway for device compromise. December 23, 2025.