Operation TaxShadow: Multi-Region Tax Phishing & In-Memory Malware Campaign

A sophisticated multi-stage malware campaign targets victims through tax-themed phishing emails impersonating Indian and Japanese government authorities. The operation leverages social engineering, fraudulent tax notifications, and trusted third-party email delivery services to distribute ZIP archives containing three staged payloads. The malware implements advanced evasion techniques including DLL Search Order Hijacking, API hooking, token manipulation, Mersenne Twister-based execution logic, COM callback execution, mutated RC4 encryption, and reflective PE loading. Execution occurs primarily in memory, significantly reducing forensic artifacts. The malware establishes persistent WebSocket-based command-and-control communication through HTTP protocol upgrades, allowing malicious traffic to blend with legitimate activity. Chinese-language artifacts were observed throughout the infrastructure and code, though attribution remains at moderate confidence. The campaign demonstrates characteristics of a mature, ...

• Anatomy of BraZetsu: How Cybercriminals Supply the Underground EcosystemMalware2026-10-02
• New RemControl Android Banking Trojan Steals PINs Using AI-Built Phishing OverlaysMalware2026-09-24
• From Registry-Stored PowerShell to In-Memory Cryptocurrency Mining: A Multi-Stage Infection ChainCampaign2026-09-21
• ChainScript: Tracing a Node.js RAT Through the BlockchainMalware2026-09-18
• SilkParasite Infrastructure: SpiceRAT Servers Tied to Energy and Government Targets Across Central AsiaMalware2026-09-16