Hackers Abuse Indian Tax Notice Lures to Deliver PE Loader and libsvcs.dll Payload

Gbhackers •Mayura Kathir • June 24, 2026

A targeted malware distribution campaign that abuses a counterfeit Indian Income Tax Department assessment notice to deliver a multi-stage Remote Access Trojan (RAT)-style payload. The threat actors hosted a fake tax-assessment portal on harivo[.]vip and used social-engineering lures official branding, tax terminology, legal references, penalties, and a “Download Assessment Order & Workings” prompt to persuade […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Fake Indian Tax Notices Used to Distribute RAT Malware A malware campaign has emerged that exploits counterfeit Indian Income Tax Department notices to deliver a Remote Access Trojan (RAT). Cybercriminals are using social engineering tactics, including official branding and legal jargon, to lure victims into downloading malicious files. The fake tax-assessment portal is hosted on harivo[.]vip, targeting users in India. Once downloaded, the malware can compromise Windows systems, allowing attackers to gain unauthorized access. This tactic has shown alarming effectiveness, raising concerns among cybersecurity experts. The campaign's current status indicates ongoing threats to individuals and organizations in India. No specific numbers of affected users or systems have been disclosed yet. 5 sources 49

Hackers Abuse Indian Tax Notice Lures to Deliver PE Loader and libsvcs.dll Payload

The full story

Extracted Entities

Attack Types (1)

Companies (1)