Taxpayers Beware! People Are Being Drained Dry in the Name of Fake Emails, Know How

New Delhi: Taxpayers are currently being targeted under the guise of the Income Tax Department. These individuals are being targeted through the dissemination of fake emails purportedly related to tax matters. Therefore, if you are planning to pay your income tax, please proceed with caution and due diligence to avoid any potential complications.

According to a report, in December 2025, the cybersecurity firm Kaspersky detected a large volume of malicious emails. These emails were designed to mimic official communications from India’s Income Tax Department; indeed, the majority of them bore a striking resemblance to legitimate emails issued by the department. In January 2026, a similar campaign emerged, this time targeting Russian organisations. Subsequently, this same malicious campaign was launched in Indonesia as well.

Discover the Malicious Files Hidden Within the Emails

Amidst the rising wave of fraud, Kaspersky identifies these malicious emails as part of an Advanced Persistent Threat (APT) campaign. In this scheme, harmful, malicious files are disguised as official documents related to tax violations. Once a device is infected, attackers can gain remote access to the compromised system and potentially steal sensitive data.

According to Kaspersky, this malicious activity has been attributed to the “Silver Fox” threat group. The structure of both waves of this malicious email campaign—the one targeting India and the subsequent one—remained nearly identical. In both instances, phishing emails were crafted to appear as official notices regarding tax audits.

Users were prompted to download an archive file, which falsely claimed to contain a list of tax violations. Upon clicking to download this archive, the file is retrieved from a public repository.

Understanding the Impact on Indian Citizens

According to a press release dated May 5, 2026, Kaspersky’s Global Research and Analysis Team has analysed several new waves of cyberattacks orchestrated by the Silver Fox group. These malicious activities have been under observation since December 2025. This campaign targeted companies in India, Indonesia, South Africa, and Russia that operate in the industrial, consulting, trade, and transportation sectors.

The phishing emails were crafted to resemble official tax audit notifications. They were designed to induce recipients to download an archive file, which allegedly contained a list of tax violations.

The attackers’ objective was to persuade victims to download the file and thereby initiate the attack sequence. In January and February alone, more than 1,600 such emails were recorded.