This campaign impersonates the Indian Income Tax Department during tax season, distributing fake penalty notices through WhatsApp from unknown or compromised accounts. The notices include forged Office Memorandums citing legitimate tax laws and impose 72-hour deadlines to pressure victims. The delivered payloads, packaged as ITD.zip files, contain malicious Android APKs and Windows executables that harvest one-time passwords (OTPs), banking credentials, and provide remote access capabilities. The attackers use disposable domains with inexpensive top-level domains and Alibaba Cloud storage for hosting payloads. The campaign is part of a broader fraud ecosystem involving refund SMS scams, cloned tax filing portals, and fake e-PAN emails. Techniques include bilingual messaging, frequent payload updates to avoid detection, and misuse of legitimate code-signing certificates, indicating significant planning and resources.

Victims risk theft of banking credentials and OTPs, potentially leading to unauthorized financial transactions and account compromise. The malware enables remote access, increasing the risk of further system compromise and data exfiltration. The campaign's use of social engineering with fake official notices and time-sensitive threats increases the likelihood of victim compliance. The broader ecosystem of related frauds amplifies the overall risk to Indian taxpayers during tax season.

No official patch or fix applies as this is a social engineering and malware distribution campaign. Defenders should educate users about this specific phishing tactic, emphasizing that the Income Tax Department does not send penalty notices via WhatsApp or impose 72-hour deadlines through such channels. Users should avoid opening unsolicited links or attachments from unknown or suspicious sources. Organizations can monitor for and block known disposable domains and Alibaba Cloud storage URLs used in this campaign. Employing mobile and endpoint security solutions capable of detecting malicious APKs and executables can help reduce risk. Since the campaign abuses legitimate code-signing certificates, reliance solely on code-signing for trust should be supplemented with behavioral detection. Patch status is not applicable; check vendor advisories for updates on detection capabilities.