Executive Summary
Securonix Threat Research has identified an active campaign dubbed TAX#TRIDENT, targeting users with fake Indian Income Tax assessment notifications. The campaign utilizes three distinct delivery paths to compromise Windows endpoints, primarily leveraging social engineering through urgency-driven tax lures. While the tooling, such as the ClientSetup payload (YTSCRat), shows strong links to Chinese commercial software and SyncFuture/Yangtu frameworks, the activity has not been definitively attributed to a specific named threat actor.
The attack chain involves various techniques including ZIP archives, VBScript downloaders disguised as images, and PHP-wrapped script delivery. In one significant branch, the attackers pivot from traditional malware to installing a legitimate, signed ManageEngine UEMS agent configured to report to attacker-controlled infrastructure. This dual-track approach—using both custom RATs and abused enterprise management software—allows the adversary to maintain durable, authenticated access to victim environments.
This campaign matters because it demonstrates the evolution of tax-themed phishing beyond simple credential theft into full endpoint management and control. The use of signed installers and legitimate management tools complicates detection, as these components often bypass traditional security filters that prioritize signature validity over behavioral context.