Tax Season, Open Season: Phishing and Malware Campaigns Targeting Indian Taxpayers

This advisory describes an active, organised tax-themed phishing campaign targeting Indian taxpayers that distributes malicious ITD.zip attachments (Android APKs) over WhatsApp and hosts disposable lookalike Income Tax websites that deliver Windows and Android malware. The report includes analysis of a signed Windows loader (ITD_Tax_Notice.exe) with hashes, observed second-stage hosting on an Alibaba Cloud OSS bucket, behavioural indicators (sandbox evasion, in-memory execution, credential/OTP theft), a long list of disposable domains used as IOCs, and practical mitigation guidance for individuals and organisations.