Fake Income Tax Application Targets Indian Taxpayers

This report analyzes an Android malware campaign impersonating India’s Income Tax Department via a fake 'iMobile' app that requests extensive permissions (including SMS replacement), captures PII (PAN, Aadhaar, DOB), banking credentials (account numbers, card number, expiry, CVV, PIN) and internet-banking logins, and actively uploads stolen data to a hardcoded C2 (http://jsig.quicksytes.com/MC/NN180521/mc.php). The analysis includes APK metadata (SHA256 provided), manifest/service abuse, deobfuscation techniques, traffic analysis, screenshots of phishing flows, and recommended mitigations and IOCs for detection and blocking.