Attackers Infect Windows Systems With Fake Income Tax Assessment Pages

Key Takeaways

• A new, sophisticated phishing campaign, dubbed TAX#TRIDENT, is targeting Windows users in India with fake income tax assessment pages.
• The attack leverages social engineering to trick victims into downloading malicious files disguised as official documents, leading to full system compromise.
• TAX#TRIDENT employs three distinct infection chains, all initiating with a tax-themed lure but diverging in their delivery and payload, often abusing legitimate remote management software.
• The threat is highly adaptable, rotating delivery methods and decoys, making traditional signature-based detection ineffective.

A new wave of malicious activity is targeting Windows users in India, employing highly convincing fake income tax assessment pages to distribute malware. This campaign, identified by researchers as TAX#TRIDENT, demonstrates remarkable adaptability in its delivery mechanisms while maintaining a consistent and urgent tax-related lure.

Unlike attacks exploiting technical vulnerabilities, TAX#TRIDENT relies entirely on social engineering. Its success hinges on the victim’s belief that the downloaded file is a legitimate government notice, prompting them to execute what is, in reality, a sophisticated piece of malware capable of full system compromise.

The campaign’s use of tax notices is particularly effective, generating a sense of urgency that can compel individuals across various professional roles—including finance, legal, HR, and executive positions—to act without sufficient scrutiny.

According to a report by Securonix Threat Research, led by Shikha Sangwan, Akshay Gaikwad, and Aaron Beardslee, TAX#TRIDENT operates through three distinct infection chains. While each path begins with the same deceptive tax theme, they diverge in their execution, providing the attackers with flexibility to switch tactics if one method is detected or blocked.

A significant challenge in combating this campaign is its abuse of digitally signed, legitimate software rather than overtly malicious files. Two of the three attack branches ultimately deploy a signed remote management client called “ClientSetup,” granting attackers persistent access to the compromised system. The third path silently enrolls the victim’s device into a genuine ManageEngine UEMS agent, redirecting it to an attacker-controlled server. This technique allows the malware to bypass security tools that rely solely on file signatures for detection.

The TAX#TRIDENT campaign continues to evolve, constantly shifting its delivery routes, decoys, and final payloads, while keeping older methods active. This inherent adaptability makes it a persistent and challenging threat for defenders.

How Fake Tax Pages Deliver Malware

The initial infection path begins with a visit to a fraudulent Indian Income Tax website, such as zyisykm.shop. Upon clicking a download button, victims receive a ZIP archive named “Assessment Letter.zip.” This archive contains a signed Windows executable designed to install a full remote management client.

Intriguingly, the attacker embeds the command-and-control (C2) server address directly within the installer’s filename. During execution, the installer reads its own name to extract this value and configure local settings. Post-installation, the executable creates a hidden directory within a Windows system folder and drops a fake svchost.exe alongside legitimate-looking driver files named YtMiniFilter and ytdisk.

A second infection vector utilizes a VBScript file, “Assessment_Order.vbs,” distributed via multiple fake tax domains. This script silently executes, displays a decoy tax image to the user, and simultaneously installs the same ClientSetup payload in the background. Despite originating from different domains and configured with varied server values, both the first and second chain executables share an identical SHA256 hash, confirming they deploy the same core payload.

Defenders are advised against relying solely on domain or filename blocklists. More robust detection should focus on behavioral anomalies, such as filenames containing IP addresses, the creation of hidden directories under system folders, svchost.exe running from unusual locations, and outbound network traffic on ports 6671, 6681, and 6683.

When Signed Tools Become the Weapon

The third infection chain deviates significantly, abandoning the ClientSetup payload entirely. This path initiates from a PHP-looking URL, xhxz.info/download.php, which surprisingly returns VBScript instead of a web page. This script then stages subsequent files from Amazon S3 buckets.

One notable file, “uacMC.png,” is not an image but a script designed to silently lower User Account Control (UAC) settings. This action effectively removes elevation prompts, paving the way for the final payload to execute without user intervention.

The ultimate payload in this chain is a full ManageEngine UEMS agent, downloaded and installed discreetly without any visible user interface. A configuration file, DCAgentServerInfo.json, directs this legitimate agent to an attacker-controlled server at 202.61.160.201 on port 8383. This method effectively hijacks a trusted enterprise tool, transforming a signed and valid agent into a silent, persistent remote access channel for the attackers.

Securonix strongly advises users to avoid downloading files from unsolicited tax or penalty links, regardless of how official they appear. Security teams should implement monitoring for script engines executing files with web-style extensions, flag svchost.exe processes running from non-standard directories, and alert on UAC policy changes where “ConsentPromptBehaviorAdmin” is set to zero.

Effective detection strategies must prioritize behavioral signals over static indicators like file hashes, given the campaign’s continuous rotation of infrastructure while its core tactics remain consistent.

Indicators of Compromise (IoCs)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

What You Should Do

• Educate Users: Conduct regular training on phishing awareness, emphasizing the dangers of unsolicited emails, messages, or links related to tax assessments, penalties, or refunds.
• Verify Sources: Instruct users to always verify the authenticity of tax-related communications directly with official government websites, never through embedded links or downloaded attachments.
• Implement Email Security: Deploy robust email security solutions with advanced threat protection, sandboxing, and URL rewriting capabilities to detect and block malicious lures.
• Enhance Endpoint Detection: Utilize Endpoint Detection and Response (EDR) solutions capable of monitoring behavioral anomalies, such as scripts executing from unusual locations, hidden directory creation, and unexpected UAC policy changes.
• Monitor Network Traffic: Implement network segmentation and monitor outbound traffic for connections to suspicious IP addresses and non-standard ports (e.g., 6671, 6681, 6683, 8383) that could indicate C2 communication.
• Disable Unnecessary Script Execution: Configure Group Policies to restrict or disable VBScript execution where it is not essential for business operations.
• Review UAC Settings: Regularly audit and enforce UAC policies to prevent unauthorized modification of security settings, specifically ensuring that ConsentPromptBehaviorAdmin is not set to zero.
• Update Security Software: Ensure all antivirus, anti-malware, and security software are kept up-to-date with the latest definitions and behavioral detection capabilities.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.