Tax-themed phishing campaign targeting Indian users with persistent access payloads
Campaign
Summary
Hide ▲
Show ▼
An ongoing tax-themed phishing campaign is targeting Indian users with a multi-stage backdoor, creating persistent access for continuous monitoring and data exfiltration. The operation uses fake Income Tax Department of India notices, making the lure relevant and increasing the likelihood of successful compromise.
Related Happenings
Silver Fox tax-themed phishing campaign delivering ABCDoor and ValleyRAT
Campaign
H score36
First: 04.05.2026 14:57
Last: 04.05.2026 14:57
Sources 1
About this happening:
Silver Fox is running a tax-themed phishing campaign that now targets India with Income Tax Department lures and delivers ValleyRAT (aka Winos 4.0). The campai...
Silver Fox tax-themed phishing campaign delivering ABCDoor and ValleyRAT
CampaignAbout this happening: Silver Fox is running a tax-themed phishing campaign that now targets India with Income Tax Department lures and delivers ValleyRAT (aka Winos 4.0). The campai...
Blackmoon (KRBanker) malware variant deployed via DLL sideloading and staged payloads
Malware Activity
H score26
First: 26.01.2026 19:01
Last: 26.01.2026 19:01
Sources 1
How related:
This is achieved by means of a DLL that's assessed to be a variant of the Blackmoon malware family, which is known for targeting businesses in South Korea, the U.S., and Canada.
About this happening:
A Blackmoon (KRBanker) malware variant is being deployed through DLL sideloading and staged payload delivery, giving operators persistent control over compromised hosts an...
Blackmoon (KRBanker) malware variant deployed via DLL sideloading and staged payloads
Malware ActivityHow related: This is achieved by means of a DLL that's assessed to be a variant of the Blackmoon malware family, which is known for targeting businesses in South Korea, the U.S., and Canada.
About this happening: A Blackmoon (KRBanker) malware variant is being deployed through DLL sideloading and staged payload delivery, giving operators persistent control over compromised hosts an...
Multi-stage phishing campaign targeting users in Russia with Amnesia RAT and ransomware
Campaign
H score34
First: 24.01.2026 13:09
Last: 24.01.2026 13:09
Sources 1
About this happening:
A multi-stage phishing campaign is targeting users in Russia, delivering Amnesia RAT and ransomware that enable credential theft, remote control, and destr...
Multi-stage phishing campaign targeting users in Russia with Amnesia RAT and ransomware
CampaignAbout this happening: A multi-stage phishing campaign is targeting users in Russia, delivering Amnesia RAT and ransomware that enable credential theft, remote control, and destr...
ESentire-observed account compromise surged 389% in 2025
Trend
H score52
First: 16.01.2026 13:40
Last: 16.01.2026 13:40
Sources 1
About this happening:
Account compromise surged 389% year over year in 2025, making it the dominant observed attack pattern and increasing credential theft and account takeover risk...
ESentire-observed account compromise surged 389% in 2025
TrendAbout this happening: Account compromise surged 389% year over year in 2025, making it the dominant observed attack pattern and increasing credential theft and account takeover risk...
Timeline
-
26.01.2026 19:01 2 articles · 5mo ago
Tax-themed phishing campaign targets Indian users with multi-stage backdoor
Initial DisclosurePhishing emails impersonating the Income Tax Department of India lure Indian users into opening a malicious archive that installs a multi-stage backdoor chain using DLL sideloading, a COM-based User Account Control (UAC) bypass, PEB masquerading as explorer.exe, and a next-stage payload fetched from eaxwwyr[.]cn. The operation is assessed to provide persistent access for continuous monitoring and data exfiltration, and to deploy Blackmoon (aka KRBanker) alongside SyncFuture TSM for remote control, logging, and security-software evasion without attribution to any known threat actor or group.
Show sources
- Indian Users Targeted in Tax Phishing Campaign Delivering Blackmoon Malware — thehackernews.com — 26.01.2026 19:01
- Indian Users Targeted in Tax Phishing Campaign Delivering Blackmoon Malware — thehackernews.com — 26.01.2026 19:01