MalwarePublished 22 Dec 2025Updated 21 Jan 2026

Indian Income Tax-Themed Phishing Campaign Targets Local Businesses

Source AlienVault OTX General

Description

A sophisticated phishing campaign impersonating the Indian Income Tax Department has been targeting local businesses. The attack begins with a spear-phishing email containing a PDF attachment that directs victims to a fake compliance portal. This triggers the download of a malicious ZIP file, which initiates a multi-stage infection chain. The payload, delivered through NSIS installers, deploys a Remote Access Trojan (RAT) with persistence capabilities. The malware harvests system information and establishes communication with command and control servers. Technical indicators suggest a China-linked development environment. This campaign demonstrates how seemingly simple tax-themed phishing can lead to complete device compromise, emphasizing the need for heightened security awareness.

Impact

For European organizations, the direct impact is limited due to the campaign’s focus on Indian local businesses. However, European companies with subsidiaries, partners, or clients in India could be at risk if employees receive similar phishing emails or if attackers pivot through compromised Indian entities. The RAT’s capabilities for persistent remote access and data harvesting pose significant risks to confidentiality, integrity, and availability of affected systems. Compromise could lead to intellectual property theft, espionage, lateral movement within networks, and potential disruption of business operations. The multi-stage infection chain and use of NSIS installers complicate detection and remediation efforts. Furthermore, the campaign highlights the risk of supply chain or third-party exposure, where European firms connected to Indian businesses might face indirect threats. Overall, this campaign underscores the importance of defending against targeted phishing and malware campaigns exploiting regional tax themes, especially for organizations with cross-border business relationships.

Defensive guidance

1. Deploy advanced email filtering and sandboxing solutions to detect and block spear-phishing emails, especially those containing PDFs and ZIP files. 2. Conduct targeted security awareness training emphasizing the risks of tax-themed phishing and the importance of verifying unexpected tax-related communications through official channels. 3. Implement Endpoint Detection and Response (EDR) tools capable of detecting NSIS installer execution, persistence mechanisms, and anomalous outbound network connections to suspicious domains or IP addresses. 4. Monitor and block network traffic to known malicious infrastructure such as the domain www.akjys.top and IP 154.91.84.3 at firewall and proxy levels. 5. Enforce application whitelisting to prevent unauthorized execution of installers and unknown binaries. 6. Regularly audit and restrict privileges related to service creation to limit malware persistence opportunities. 7. Maintain up-to-date threat intelligence feeds to stay informed about emerging phishing campaigns and indicators of compromise. 8. Establish and rehearse incident response procedures to quickly isolate and remediate infected systems. 9. For organizations with Indian business ties, implement additional scrutiny on tax-related communications and verify authenticity through official government channels. 10. Use multi-factor authentication and network segmentation to reduce the impact and lateral movement potential of RAT infections.

Indicators of compromise

Domains 1

www.akjys.top

URLs 1

https://www.akjys.top/

IP addresses 1

154.91.84.3

Hashes 1

4001854be1ae8e12b6dda124679a4077

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 5 Jan 2026, 11:08 UTC

MITRE ATT&CK techniques17 from threat tags

Technical details