Malware — 9 posts

Discrepancies have been identified during the review of your company's tax records. That sentence is almost all there is to the fourth draft of a forged Income Tax Department notice this archive has followed since August. Every section number, office, officer's name and amount that the earlier drafts quoted is gone; the 72-hour clock and the link remain. The link asks for a ZIP archive named like a PDF, on a name handed out under eu.cc, and when the recipient detonated it in a secured sandbox, the server sent back a page instead: Access Denied. Hosting/VPN IP detected. Only real users are allowed.

COURT NOTICE. Case Number: [ITD/2026/ND/458721]. Hearing Date: September 17, 2026. Time: 10:30 AM. The 4 September court notice sent again from a new Outlook mailbox — its case number unchanged, its link moved to a domain that its registrar has since put on hold, and its hearing set for a time that had passed two and a half hours before the email arrived.

This tax invoice contains proprietary information. Please download the attachment and enter the file password to view it. A GST invoice that masks its supplier, its goods and its bank account, names no buyer, and arrives with a password-protected ZIP — whose password is printed in the email, and again in the attachment's own filename.

Intimation under Section 143(1) of the Income Tax Act, 1961, cross-verified with AIS, TIS, and SFT, with a total corporate demand of ₹ 2,73,250 payable in fifteen days. The penalty-notice template's third draft — sharing its reply-to with the 7 September version — now dressed as a CPC Bengaluru intimation, with a fabricated DIN, a demand table that cites a Section 234F fee at a ceiling that was cut in half four years ago, and a ZIP to download.

Review of your return found under-reported income and undisclosed foreign assets. Refer to the attachment for full details. A bilingual Income Tax Department notice that says nothing about the tax, the amount, or the taxpayer, and defers to a ZIP file in every other sentence — sent from a domain registered seventeen days earlier, through a real-looking government address pasted into the wrong half of the sender.

COURT NOTICE. Case Number: [ITD/2026/ND/458721]. Investigating Authority: Income Tax Department, Government of India. Hearing Date: 30 September 2026. The court-notice template's fourth draft, back in English and back on a free Outlook mailbox. This time we followed the link to the end: a disk image carrying a signed Tencent WeChat executable and the malicious DLL it loads.

Your payment has been successfully processed. Please find the attached SWIFT advice and supporting documentation for your records. Four lines of flawless business English, a Re: subject line for a conversation that never happened, and a 140 KB PDF that is the entire attack.

The tax inspection of your company has revealed irregularities under Section 271(1)(c) of the Income Tax Act, 1961. A forged Government of India memorandum sent from a free Outlook mailbox, demanding documents within 72 hours via a Chinese gaming domain.

Missed Call Notification - New VM Recordlng Recelved - MSG 00:01:30 Ref:9b4e56919bf06b17b131774fd036e27fed8e7e00 from intrinsicvccdcsystem@i-ntrinsic.com.