Income Tax Department Phishing Campaign Uses Malicious Tax_Assessment.img to Drop Malware

Threat actors have launched a sophisticated phishing campaign targeting Indian individuals and organizations by impersonating the Income Tax Department.

The attackers host a fraudulent tax-themed website on the domain harivo[.]vip, which was recently registered and is currently hosted on Hong Kong-based infrastructure.

This fake portal closely mimics official government communications by using legal references, financial penalties, and compliance instructions to create a sense of urgency.

The campaign demonstrates a high level of social engineering, exploiting regional trust and regulatory anxiety.

When victims visit the fabricated portal, they are presented with a fake assessment order containing fabricated taxpayer information.

The site encourages users to interact with a download button to access their supposed assessment order and workings.

Clicking this button triggers the download of a malicious ZIP archive disguised as official tax documentation. This initial access technique effectively bypasses user suspicion by leveraging the inherent authority of government tax communications.

Tax Assessment Malware Scam

The attack chain relies on a multi-stage malware delivery system to establish a secure foothold in targeted Windows environments. The initial download is a ZIP archive named Tax_Assessment_0609.zip.

Once extracted, it reveals a malicious disk image file named Tax_Assessment.img. This disk image acts as a container for the next stage of the infection, holding two critical components necessary to execute the attack.

The first component in the disk image is a Portable Executable file named Tax_Assessment.exe, which serves solely as a loader. The second component is a Dynamic Link Library named libsvcs.dll, which serves as the primary malware payload.

The execution process deliberately separates the loader from the main payload to evade detection and complicate reverse engineering efforts.

The executable dynamically loads the DLL payload via reflection, specifically via the Assembly.LoadFrom() method to invoke malicious functions without triggering standard security alerts.

To further complicate automated analysis, the threat actors applied ConfuserEx obfuscation to both the executable and the DLL. The malware also employs several defense evasion techniques to blend in with normal system operations.

The executable hides its console window at launch and modifies the user’s registry settings to support quiet execution.

Furthermore, the DLL payload contains spoofed assembly metadata, using misleading identification details such as “Runtime Service Host” and claiming publication by “Microsoft Corporation” to reduce suspicion.

Cyfirma said, the malware exhibits persistent behavior highly consistent with the XWorm Remote Access Trojan family. The payload establishes persistence through startup registration, auto-run modifications, and scheduled task creation.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.