Urgent cybersecurity alert: Hackers impersonate Indian Income Tax department using sophisticated malware

Mimecast’s Threat Research team has uncovered an active and highly targeted malware campaign impersonating the Indian Ministry of Finance and Income Tax Department. Active since October 2025, the operation specifically targets multinational organisations headquartered in the UK and US with operations or subsidiaries in India – delivering dangerous payloads designed for data theft and long-term system compromise.

This latest assault follows a disturbing surge in tax-related cyber frauds throughout 2025, including widespread phishing scams promising fake income tax refunds (often ₹50,000–₹60,000) that tricked victims into sharing bank details, and a November 2025 zero-day campaign that impersonated the Income Tax Department to deliver AsyncRAT malware. The Income Tax Department itself has repeatedly warned taxpayers about rising fake emails, SMS, and fraudulent websites exploiting filing season urgency.

Cybercriminals are now sending deceptive “office communications” alleging serious tax violations under Section 271(1)(c) of the Income ...