Tax Phishing Emails Deliver In-Memory Malware to Windows Systems

This report details a tax-themed phishing campaign (attributed to Silver Fox) that delivers fileless, in-memory modular RATs via multi-stage chains — including PDF/ZIP lures, NSIS installers, DLL hijacking, Donut-wrapped shellcode, COM callback execution, and WebSocket C2 — targeting Indian organizations; it provides IOCs and recommends detection controls such as application whitelisting and memory-scanning.