Threats tagged 'whatsapp delivery'

VulcanRAT207.A is a sophisticated multi-stage malware intrusion chain initiated via a WhatsApp-delivered financial document lure. The malware uses compression and extensive host screening before escalating privileges to SYSTEM level through COM-based techniques and PoolParty Variant 7 injection. It deploys a signed driver to disable security processes, establishes persistence via DLL side-loading with a legitimate Intel-signed executable, and launches a WebSocket-based remote access trojan. The final payload provides extensive surveillance capabilities including shell access, keystroke logging, desktop control, network filtering, and process injection.

A sophisticated malware campaign is targeting Indian taxpayers during filing season by impersonating the Income Tax Department. Attackers distribute fake penalty notices via WhatsApp from unknown or compromised accounts, using forged Office Memorandums citing legitimate tax law sections and creating 72-hour deadlines to induce panic. The campaign delivers ITD.zip files containing malicious Android APKs and Windows executables that harvest OTPs, banking credentials, and enable remote access. The infrastructure relies on disposable domains using cheap TLDs and Alibaba Cloud storage for payload delivery. This activity is part of a broader ecosystem including refund SMS fraud, cloned e-Filing portals, and fake e-PAN emails. The operation demonstrates resource and planning through bilingual content, payload rotation to evade detection, and abuse of legitimate code-signing certificates.

Campaign#phishing#indiaIndia