Cybercriminals are exploiting India’s ITR filing season with fake Income Tax notice delivered over WhatsApp and other messaging apps. The campaign uses forged government documents, cloned e-filing portals and malware to steal banking credentials and gain remote access to victims’ devices. The attackers send a fake Office Memorandum through WhatsApp and other messaging apps. The notice carries the Government of India emblem, bilingual Hindi-English text, fabricated reference numbers and a fake signatory claiming to be “Raj Kumar Sharma, Assistant Commissioner of Income Tax.” It cites Section 271(1)(c) and Section 276C of the Income Tax Act and gives recipients just 72 hours to respond. The fake notices create a sense of urgency designed to pressure taxpayers into acting without verifying the communication. The findings are based on scam samples shared by victims on X and phishing infrastructure analysed by CloudSEK researchers.
Also read: New Income Tax Rules to Come into Effect from April 2026: Key Changes Explained in Simple Terms
The researchers found that attackers are exploiting taxpayers’ fear of penalties and expectation of refunds. The campaign uses convincing government branding, legal references and strict deadlines to pressure victims into acting without verification. “Tax season gives attackers the perfect opportunity to exploit trust and urgency. People expect messages about refunds, notices and compliance deadlines. This campaign combines convincing government impersonation with sophisticated malware delivery to bypass both human judgement and traditional security controls. Taxpayers should remember one simple rule: the Income Tax Department does not send statutory notices, penalty orders or summons over WhatsApp,” said Shobhit Mishra, Threat Intelligence Researcher, CloudSEK.
CloudSEK observed these messages coming from unknown or compromised WhatsApp accounts with names such as “Sunil Sharma,” “jankiforex” and “Hotel Oyster.” In one case, attackers shared the file in a WhatsApp group. The attachment, ITD.zip, does not contain tax documents. It delivers malware instead. Researchers found multiple versions of the archive ranging from 2 MB to 35 MB. The changing file sizes indicate payload rotation, a technique attackers use to bypass traditional malware detection.
The report states that both Android and Windows users are being targeted through different malware variants. On Android devices, the ZIP archive installs a malicious APK capable of intercepting SMS messages and banking OTPs, stealing credentials, harvesting contact lists and displaying fake banking interfaces to capture sensitive information. For Windows users, the attack delivers a malicious executable named ITD_Tax_Notice.exe. CloudSEK’s analysis found that the executable disguises itself as Microsoft’s svchost.exe, uses a valid Extended Validation (EV) certificate to appear legitimate and downloads a second-stage payload from Alibaba Cloud. The malware also performs victim profiling, checks whether it is running in a sandbox environment and executes additional code directly in memory, making detection significantly more difficult for conventional security solutions.
Beyond messaging platforms, CloudSEK identified dozens of newly registered domains impersonating the Income Tax Department. These phishing websites display the same forged penalty notice and prompt users to click a “Download Documents” button, which instead installs malware. Researchers found the domains hosted on disposable websites using low-trust top-level domains such as .lol, .xin, .ink and .autos. None of these domains belong to the official incometax.gov.in website, allowing attackers to quickly replace blocked domains with new ones.
Also read: Union Budget 2025: No Income Tax for Salaries Up to Rs 12 Lakh
Some of the other parallel campaigns targeting taxpayers during the ITR filing season:
- Fake refund messages over SMS, email and WhatsApp.
- Cloned income tax e-filing portals.
- Fraudulent e-PAN verification emails.
- Fake tax consultants and refund agents promising higher or faster refunds.
All these campaigns use the same tactic. They create urgency, impersonate trusted institutions and trick victims into sharing credentials or installing malware. Tax payers are advised to ignore any Income Tax notice received through WhatsApp or SMS. Users should access the Income Tax portal only by typing incometax.gov.in directly into their browser and verify every notice independently. According to CloudSEK, users who have opened ITD.zip or any similar file should immediately disconnect the affected device from the internet, change all passwords using a trusted and uncompromised device, enable multi-factor authentication (MFA), perform a comprehensive malware scan, and report the incident to the National Cybercrime Helpline (1930) or through the Cyber Crime Reporting Portal.
