Fake Income Tax Assessment Notice Delivers RAT-Like Malware to Windows Users

A Cyfirma-reported campaign uses a counterfeit Income Tax Department portal (harivo.vip) and a malicious ZIP (Tax_Assessment_0609.zip) that mounts a disk image (Tax_Assessment.img) to drop a .NET loader (Tax_Assessment.exe) and an obfuscated DLL (libsvcs.dll) which implements RAT functionality (XWorm-like) with persistence, system reconnaissance, and encrypted C2 to 103.231.12.27:4444; the report includes multiple IoCs (SHA-256/MD5 hashes, filenames, domain, IP) and recommends monitoring, blocking outbound traffic, user training, and forensic containment.