Filing season in India has brought a wave of forged tax penalty notices delivered straight into people's chat apps. CloudSEK researcher Shobhit Mishra documented the campaign, built from scam samples victims posted publicly alongside phishing infrastructure the team analysed directly. The single fact worth carrying into the season: the Income Tax Department does not serve statutory notices, penalty orders or summons over WhatsApp. A tax notice that arrives as a chat attachment from an unknown number is fraudulent, without exception.
What the lure looks like
The message arrives from an unknown or compromised account as an Office Memorandum on Income Tax Department letterhead. It is a competent forgery. It carries the Government of India emblem, a Ministry of Finance header, the Aayakar Bhawan address in New Delhi, a fabricated file number, and bilingual Hindi and English text that reads the way government correspondence actually reads. It cites real law, alleging irregularities under Section 271(1)(c) of the Income Tax Act, 1961 and threatening prosecution under Section 276C, and it is signed by a fictitious Assistant Commissioner. Then it gives the recipient 72 hours.
CloudSEK observed the same script reused verbatim across sender profiles with names such as Sunil sharma, jankiforex and Hotel Oyster, all flagged by the messaging app as not a contact, and at least one delivered inside a group chat. The rest of the ecosystem around it is familiar: refund pending text messages, cloned e-Filing portals, fake e-PAN emails, and refund agents who exist to harvest personal data.
What the attachment actually does
The file is called ITD.zip. On Android the payload is an application package, and installing it is the entire point of the operation. Malware of this class requests broad permissions and can then read and intercept text messages, which includes the one time passcodes banks send to authorise transfers, harvest contacts to push the same file onward, log keystrokes, and draw fake screens on top of banking and payment apps to capture credentials.
Desktop victims, including anyone opening the archive through the web version of the messenger, receive a Windows executable named ITD_Tax_Notice.exe instead. CloudSEK detonated the sample and found a small first stage disguised as a legitimate Windows system process, carrying a real code signing certificate issued to a sole proprietor registered in Linyi, Shandong. It fingerprints the machine, then pulls a second stage from an Alibaba Cloud storage bucket in Hong Kong as a raw binary blob, which is decrypted and run in memory so the real payload never lands on disk as a scannable file.
The archive has been served at roughly 2 MB, 34 MB and 35 MB across samples. Different sizes for the same lure indicate payload rotation, a routine way of staying ahead of signature based detection.
How to recognise the infrastructure
The phishing pages sit on disposable domains using cheap low trust extensions such as .lol, .xin, .ink and .autos. None of them are incometax.gov.in. The specific domains will be dead within days, so the pattern matters more than any single address: a random consonant string on a throwaway extension, no relationship to any government namespace, and one call to action that downloads a file.
What to do
Never install an application sent to you in a chat, whoever it claims to be from. Check any tax communication only by logging in at the official portal yourself rather than through a link or attachment. If someone in your organisation has already installed it, treat the device as fully compromised: assume credential theft and remote access, reset banking and email passwords from a clean device, and contact the bank about intercepted one time passcodes rather than trusting messages still arriving on the phone. Our India country profile tracks the wider threat picture, and this campaign follows the same chat app abuse pattern seen in the Brazilian banking trojan that hijacks WhatsApp to spam contacts and the RedHook Android trojan.
Indicators
Windows first stage SHA-256 667b37eafb9ec5131ed4f017ed429a47dca3adf626b2fc85fc6424b1e17ff6e1, MD5 dff2b7a23882445b4e354199bf38554f, filename ITD_Tax_Notice.exe. Second stage staged at hxxps://vss2[.]oss-cn-hongkong[.]aliyuncs[.]com/88[.]bin, hosted at 47[.]79[.]66[.]58. Sample lure domains include apeal[.]lol, tarif[.]lol, gova[.]bar, bcgovtop[.]lol, ingovtop[.]click, gov-xnui[.]com and a long tail of .xin and .ink names. Archive filename ITD.zip. All indicators are defanged.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.