A suspected China-linked hacking group is going after Indian taxpayers — and they’re getting clever about it.
Seqrite Labs is calling it Operation DragonReturn. The campaign started around May 18, 2026, right as India’s annual tax filing season kicked off. Spear-phishing emails pretend to be from India’s Income Tax Department. They cite real tax laws. They look official. They’re anything but.
Here’s how it works. The phishing emails carry PDF attachments with a link to “govtop[.]one/incometax.” That site offers a ZIP file disguised as a legitimate tax filing utility. But the ZIP contains a malicious DLL that sideloads into memory.
If you run it? The malware checks for admin rights. If it doesn’t have them, it pops a UAC prompt to trick you into granting elevation. Then it pulls a JPG from a hardcoded server (204.194.48[.]250), hides a 504 KB DLL inside the image, and writes it to your Windows Media Player folder.
From there, it copies itself as “Mixed Reality.exe” and sets up a Windows service called MixedSvc that auto-starts on boot. That’s persistence. That’s staying power.
The goal? DcRAT — a remote access trojan that steals data. The attackers can take screenshots, exfiltrate files, and pretty much own the machine. Seqrite found the C2 server at 223.26.63[.]40 running a Chinese-language admin panel.
Seqrite also sees connections to Silver Fox, a Chinese cybercrime group known for tax-themed phishing and ValleyRAT deployments. Infrastructure overlaps and tactical similarities suggest this might be the same crew.
Meanwhile, LevelBlue separately spotted ValleyRAT campaigns using fake LINE installers and salary-adjustment phishing emails. One campaign even uses the PoolParty injection technique, previously tied to the REF3864 group’s SADBRIDGE loader.
The takeaway? Tax season is phishing season. If an email threatens a tax penalty and asks you to download a “utility,” think twice.
