Beyond Tax Returns: How Shared Malware Infrastructure Scales Brand Abuse In Indonesia

A sophisticated fraud campaign exploiting Indonesia's tax season targeted 67 million residents through fake Coretax applications distributed via phishing websites and WhatsApp social engineering. The GoldFactory threat cluster orchestrated operations using Gigabud.RAT and MMRat malware families with shared infrastructure abusing over 16 trusted brands across government and financial sectors. The attack chain combines vishing, screen recording, and remote access capabilities to achieve device compromise and unauthorized financial transfers. Estimated financial impact reaches USD 1.5-2 million nationwide, with global implications extending to USD 6 million annually across multiple countries. The industrialized malware-as-a-service infrastructure enables horizontal scaling across Thailand, Vietnam, Philippines, and South Africa, demonstrating a shift toward unified cross-border operations that systematically undermine trust in digital government services.

• How VBScript Malware Evades Detection Using Trusted Tools CopyMalware2026-10-27
• False Protection, Emptied Accounts: The Seven Android Trojan Families Targeting Indian Banking AppsMalware2026-10-28
• Managed for Malice: How Attackers Turn MDM into Remote AccessCampaign2026-10-28
• Inside "MR ROBOT" - Anatomy of a Malware-as-a-Service Operation Targeting Indian Bank CustomersMalware2026-10-28
• Tricks from the Past deployed via signed ChatGPT and Claude binariesMalware2026-10-27