Operation TaxShadow: Tax Phishing Hides In-Memory Malware

Operation TaxShadow is a sophisticated, multi-stage phishing campaign masquerading as government tax notices that distributes a ZIP archive containing a loader EXE, a malicious SbieDll.dll that installs API hooks and a Mersenne-Twister VM, and an encrypted SbieDll.bin which is reflectively loaded into memory; the malware uses DLL search-order hijacking, memory-only execution, WebSocket-based C2, proxy tunneling, and process injection (e.g., svchost.exe) to avoid detection.