Operation DragonReturn spear-phishing PDF lure with govtop.one/incometax URL

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects spear-phishing emails associated with Operation DragonReturn, which impersonates the Indian Income Tax Department. The rule identifies emails containing malicious PDF attachments (e.g., 2026-0610-1.pdf) or directing users to the known phishing domain 'govtop.one', commonly used to harvest credentials or deliver malware.