Malicious GST Debit Note Attachment Deploys Remcos RAT Through Multi

Cybersecuritynews •Tushar Subhra Dutta • June 22, 2026

A sophisticated phishing campaign is actively targeting users in India by disguising malware as a routine GST debit note. The attack delivers a powerful remote access tool called Remcos RAT through a cleverly constructed multi-stage loader, giving attackers deep and persistent control over infected systems. What makes this threat especially alarming is how the entire […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Phishing Campaign Uses GST Debit Note to Deploy Remcos RAT A phishing campaign is targeting users in India with a malicious attachment named 'GST Debit Note Apr_26.com.' This attachment is a multi-stage steganographic loader that delivers the Remcos RAT, enabling attackers to gain remote access to infected systems. The loader is sophisticated, allowing for the deployment of multiple infostealers. The attack method involves disguising the malware as a legitimate document, which increases the likelihood of user interaction. The campaign is ongoing and has raised significant concerns among cybersecurity professionals due to its stealth and effectiveness. No specific numbers of affected users or systems have been disclosed, but the global scope of the phishing campaign suggests a wide-reaching impact. Current status indicates heightened vigilance is needed among potential targets. 2 sources 67

Extracted Entities

Malicious GST Debit Note Attachment Deploys Remcos RAT Through Multi

The full story

Extracted Entities

Attack Types (1)

Countries (1)

Malware (2)

MITRE ATT&CK (1)