New Phishing Attack Mimic as Income Tax Department of India Delivers AsyncRAT

### Executive Summary — A sophisticated November 2025 phishing campaign impersonating the Income Tax Department of India targeted securities, financial firms, and NBFCs with bilingual, legally framed emails that used password‑protected ZIPs and regsvr32 proxy loading to deliver a multi‑stage payload (leading to a Remote Access Trojan and credential theft), later leveraging Google Docs for secondary payload delivery; Raven analysts identified inconsistencies that prevented wider compromise.