Fake Tax Assessment Pages Spread Windows Malware

TAX#TRIDENT is an active Windows-targeting campaign that uses convincing fake Indian Income Tax assessment pages and varied delivery methods (ZIP archives, VBScript decoys, PHP-served scripts) to install a signed ClientSetup malware. The payload creates hidden directories and services (e.g., MANC service, fake svchost.exe), achieves persistence via services and drivers, abuses legitimate ManageEngine UEMS software, and maintains multiple C2 channels (noted ports 6671, 6681, 6683) for system registration, command execution, and data transfer; defenders should monitor unusual script execution, unexpected service creation, and outbound connections to unknown servers.