Tax Phishing Emails Deploy In-Memory Malware on Windows Systems

Key Takeaways

• A sophisticated multi-stage malware campaign, dubbed “Operation TaxShadow,” is targeting Windows users through convincing tax-themed phishing emails.
• The threat utilizes in-memory execution and DLL search order hijacking to evade detection by traditional antivirus solutions, leaving minimal forensic traces.
• Initial targets include individuals in India and Japan, with attackers impersonating government tax authorities.
• The malware establishes covert command-and-control communication via WebSockets, further complicating detection.

Sophisticated Tax Phishing Campaign Delivers In-Memory Malware to Windows Systems

Cybercriminals are deploying a highly advanced, multi-stage malware against Windows users, leveraging deceptive tax notification emails. This threat, operating almost entirely within memory, is meticulously designed to bypass conventional security measures and leave negligible forensic evidence.

Operation TaxShadow: A Multi-Region Threat

Dubbed “Operation TaxShadow,” this campaign has been active since at least May 20, 2026. It primarily targets individuals by impersonating official Indian government tax authorities. The phishing emails are expertly crafted to induce panic, threatening recipients with financial penalties and demanding immediate action to meet imposed deadlines.

The initial point of compromise involves a highly convincing email, complete with authentic-looking logos and language from legitimate Indian tax enforcement bodies. Victims who click embedded links are redirected to a fraudulent government website that meticulously mimics the real one, even featuring bilingual English and Hindi content. From this deceptive portal, users are prompted to download a ZIP archive, presented as an official tax document. In reality, this file contains a fully weaponized malware package poised to compromise their system.

Researchers at Cyfirma identified the campaign, noting its broader scope beyond a single region. The same infrastructure that hosted the fake Indian tax portals was also found to be hosting fraudulent Japanese government tax websites. Cyfirma’s report, shared with Cyber Security News (CSN), highlighted that the combination of memory-resident malware, advanced evasion techniques, and shared infrastructure points to a well-resourced and mature threat operation.

Advanced Evasion Techniques and Multi-Stage Deployment

A critical aspect of this campaign’s danger lies in its post-infection behavior. The malware’s payload executes almost entirely in memory, avoiding writing any files to disk. This “fileless” approach renders many standard antivirus products ineffective. Furthermore, the malware maintains a persistent connection to its command-and-control (C2) servers using traffic designed to blend seamlessly with legitimate web activity.

The phishing emails successfully bypassed common email authentication checks, including SPF, DKIM, and DMARC. This was achieved by sending the malicious emails through a legitimate third-party email delivery service, allowing them to circumvent spam filters and reach inboxes without triggering immediate red flags.

Malware Architecture and Execution Flow

The malicious ZIP archive contains a sequence of three components: a launcher, a loader library named SbieDll.dll, and an encrypted payload file, SbieDll.bin. The launcher initiates the attack by preparing the execution environment, verifying the Windows version, and installing hooks into crucial system functions before transferring control to the loader. This modular design, with each file serving a specific purpose, helps to segment functionality and minimize the exposure of the final payload.

The loader, SbieDll.dll, exploits a technique known as DLL Search Order Hijacking. Windows prioritizes an application’s local folder over system directories when loading libraries. By strategically placing the malicious DLL in the appropriate location, the attackers force Windows to load their rogue library instead of the legitimate one. Following this, the loader manipulates access tokens and removes permission restrictions, further preparing the environment for the final stage of the attack.

The ultimate component, SbieDll.bin, contains the core malware payload, encrypted with a modified RC4 cipher. Upon decryption during runtime, this payload is loaded directly into memory using Reflective PE Loading. This means the executable never touches the disk, explaining why traditional signature-based security products struggle to detect this sophisticated threat.

Covert C2 Communication and Anti-Analysis Mechanisms

Once active, the malware establishes communication with its C2 server via WebSocket connections. This method is commonly employed by legitimate web applications, allowing the malicious traffic to appear normal to network monitoring tools. The session begins as a standard HTTP request and then upgrades to a persistent channel, making it difficult to differentiate from benign network activity. The malware also supports HTTP CONNECT, enabling it to route communications through corporate proxies and bypass enterprise network controls.

To further thwart analysis, the malware incorporates a Mersenne Twister-based engine that introduces variations in execution behavior across different infections, rendering signature-based detection unreliable. It also utilizes Control Flow Flattening to obfuscate its code structure and resolves Windows API calls at runtime through hashing, effectively hiding its true intent from static analysis tools.

Cyfirma researchers discovered Chinese-language strings within the phishing page source code, including a phrase translating to “Official Tax Notice.” However, they cautioned that this alone is insufficient to definitively confirm the attackers’ origin.

What You Should Do

• Enhance Security Awareness Training: Regularly educate users on identifying phishing attempts, especially those impersonating government entities. Emphasize vigilance against urgent requests and suspicious links.
• Implement Advanced Endpoint Detection and Response (EDR): Utilize EDR solutions capable of continuous memory monitoring to detect fileless malware and anomalous process behavior that bypasses traditional antivirus.
• Deploy YARA and Sigma Rules: Develop and deploy custom YARA and Sigma rules to detect patterns associated with DLL hijacking, reflective loading, and WebSocket C2 communications.
• Strengthen Email Security Gateways: Implement robust email security solutions with advanced threat protection, sandboxing, and DMARC enforcement to flag and block sophisticated phishing attempts, even those using legitimate third-party senders.
• Monitor Network Traffic for Anomalies: Employ network intrusion detection systems (NIDS) and network traffic analysis (NTA) tools to identify unusual WebSocket connections or C2 patterns.
• Regularly Update and Patch Systems: Ensure all operating systems and applications are kept up-to-date with the latest security patches to mitigate known vulnerabilities.

Indicators of Compromise (IoCs):

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.