Back Techradar

Careful when filing your taxes, this new "PackClient" malware is hitting global firms via tax audit lures

Techradar • September 1, 2026

Attack spoofed tax authority emails in China and India, delivering PackClient installer

RAT offers advanced features; researchers warn broader adoption likely beyond Asia

For almost three months, Chinese hackers have been distributing an advanced Remote Access Trojan (RAT) called PackClient, against organizations in mainland China and India.

According to security researchers Proofpoint, PackClient is being actively sold on Telegram channels. It is a rather advanced RAT, capable of file theft and management, remote shell execution, screen capture and remote desktop management, webcam access, keylogging, privilege escalation, system administration, and a myriad of other things.

Even though it’s actively sold on Telegram, so far just one hacking group was spotted using it - TA4922. This is not a state- group but rather a financially motivated one.

Picking up the malware

Since late May 2026, this group has been mailing organization, first in China, and later in India, as well. In the emails, they spoofed local tax authorities, claiming that the recipients were needed to conduct “self-inspection”, a process which included downloading and filling out paperwork shared in the attachment.

The “paperwork”, however, was nothing more than the PackClient installer.

In its report, Proofpoint did not say how many organizations fell victim to the attack, nor did it in which industries most victims operated.

However, in earlier reports, the researchers said TA4922 typically targets small and medium-sized organizations located primarily in Japan. Other notable mentions include Taiwan, Korea, Singapore, and India, while in newer times, they also started targeting European organizations, as well as those in the UK.

Proofpoint also stressed that the advanced capabilities of PackClient might see it getting picked up by many more threat actors, and see it getting deployed against more organizations, particularly in the western part of the world.

“Given that PackClient is marketed through Telegram making it broadly available, it is likely other threat actors are currently using, or will use, this malware in future campaigns,” they said. The researchers also shared a full list of Indicators of Compromise ( IoC ), in case you’re suspicious of an infection.

➡️ Read our full guide to the best antivirus 1. Best overall: Bitdefender Total Security 2. Best for families: Norton 360 with LifeLock 3. Best for mobile: McAfee Mobile Security

Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

PackClient RAT Targets Global Firms via Tax Phishing Campaigns TA4922, a financially motivated threat actor, has been distributing the PackClient RAT since late May 2026, primarily targeting organizations in China and India. The malware is delivered through spoofed emails claiming to be from local tax authorities, urging recipients to download malicious attachments. PackClient offers advanced features such as remote access, file theft, and keylogging. Researchers from Proofpoint have confirmed the malware's availability on Telegram, indicating a potential for broader adoption by other threat actors. The attack has raised concerns about its impact on small and medium-sized enterprises, particularly in Asia, with indications that it may expand to Western organizations. Organizations are advised to monitor for suspicious activity and implement strict controls on executable downloads. The current status of the campaign is active, with ongoing distribution and exploitation efforts. 3 sources 68

Extracted Entities

Careful when filing your taxes, this new "PackClient" malware is hitting global firms via tax audit lures

The full story

Extracted Entities

APT Groups (1)

Attack Types (3)

Countries (5)

Malware (1)

MITRE ATT&CK (7)