Scams & Phishing News Tax Phishing Emails Deliver In-Memory Malware to Windows Systems

[Brownie2019]

Content source

https://gbhackers.com/tax-phishing-emails-deliver-in-memory/

Cybercriminals are leveraging tax-themed phishing emails to deploy sophisticated in-memory malware on Windows systems, bypassing traditional disk-based detection mechanisms.

The attack cascade begins when victims receive phishing emails containing malicious attachments disguised as official tax documents, W-2 forms, or rejected tax form notifications from legitimate entities like Intuit QuickBooks or HM Revenue & Customs.
When opened, these attachments trigger a multi-stage execution chain that never writes malicious code to disk. Instead, attackers leverage legitimate Windows administration tools including PowerShell, mshta.exe, and Windows Management Instrumentation to execute shellcode loaders entirely in memory.

The most recent campaigns attributed to threat actor Silver Fox specifically target Indian organizations and individuals, employing highly convincing tax-themed lures that mimic official communications from tax authorities.

The attack begins with a PDF attachment masquerading as an official tax document that redirects victims to a website serving a ZIP archive. Inside, an NSIS installer drops a legitimate signed binary alongside a malicious DLL, which loads through DLL hijacking to bypass security controls.

Full Story:

Tax Phishing Emails Deliver In-Memory Malware to Windows Systems

Cybercriminals are leveraging tax-themed phishing emails to deploy sophisticated in-memory malware on Windows systems, bypassing traditional disk-based detection mechanisms.

gbhackers.com

 

[Bot]

Full Story:

Tax Phishing Emails Deliver In-Memory Malware to Windows Systems

Cybercriminals are leveraging tax-themed phishing emails to deploy sophisticated in-memory malware on Windows systems, bypassing traditional disk-based detection mechanisms.

gbhackers.com

This report describes a phishing campaign that uses tax-themed lures to deliver in-memory malware, a technique that has been observed in multiple threat reports.

Key points from the description

• Emails impersonate tax authorities or services such as Intuit QuickBooks or HM Revenue & Customs.
• Payloads rely on legitimate Windows tools (PowerShell, mshta.exe, WMI) to avoid writing files to disk.
• Recent activity attributed to the Silver Fox actor targets Indian users with PDF-to-ZIP delivery chains and DLL hijacking.

Practical steps

• Treat unexpected tax-related attachments as suspicious regardless of the sender name.
• Scan any received files with multiple reputable security products before opening.
• Submit suspicious samples to VirusTotal or similar services for community analysis.

Staying alert to these delivery methods remains the most effective immediate defense.