Bengaluru: Cybercriminals are exploiting the income-tax return (ITR) filing season by sending fake Income Tax Department notices over WhatsApp and other messaging platforms, using forged government documents, cloned tax portals and malware to steal banking credentials and gain remote access to victims’ devices, according to a report by Bengaluru-based cybersecurity firm CloudSek.The campaign comes at a time when millions of taxpayers are expecting messages related to refunds, notices and compliance deadlines, making them more likely to trust official-looking communications.CloudSek said attackers are using two primary methods: malware-laden WhatsApp attachments and phishing websites that closely mimic the official income-tax e-filing portal.In the WhatsApp campaign, victims receive an “office memorandum” from an unknown or compromised account masquerading as the Income Tax Department. The forged document features the Government of India emblem, bilingual English and Hindi text, fabricated reference numbers and the name of a fake tax official to appear authentic.The notice falsely claims that discrepancies have been detected under Section 271(1)(c) of the Income Tax Act and warns of prosecution under Section 276C, giving recipients just 72 hours to respond.Instead of including a web link, the message carries a ZIP attachment named “ITD.zip”, presented as tax documents. On Android devices, opening the file installs malware capable of accessing SMS messages, including banking one-time passwords (OTPs), contacts and keystrokes. The malware can also overlay fake login screens on banking and payment applications to capture usernames, passwords, and other sensitive information.Users opening the attachment through WhatsApp web face a different threat. CloudSek found that the ZIP file can deliver a malicious Windows executable disguised as an income-tax notice, potentially giving attackers remote access to infected computers.The cybersecurity firm said the ZIP archive has been observed in multiple sizes — including 2 MB, 34 MB and 35 MB — indicating payload rotation, a technique attackers use to evade antivirus software that relies on static signatures.In a parallel campaign, fraudsters direct users to websites designed to closely resemble the official income-tax e-filing portal. These fake sites prompt users to enter PAN, Aadhaar, passwords, OTPs, and bank account details.CloudSek said the campaign overlaps with tax-themed malware operations observed earlier this year that distributed remote-access trojans and information-stealing malware, suggesting that victims should treat any infection as a serious compromise rather than a minor nuisance.“Tax season gives attackers the perfect opportunity to exploit trust and urgency. People expect messages about refunds, notices and compliance deadlines,” said Shobhit Mishra, threat intelligence researcher at CloudSek. He added that the combination of government impersonation, legal references, and malware is designed to bypass both user judgement and conventional security controls.
