Fake tax notices on WhatsApp target ITR filers; malware steals banking credentials

Cybercriminals send fake Income Tax Department notices via WhatsApp with forged documents and malware to steal banking credentials.

Fake notices cite Section 271(1)(c) and Section 276C of the Income Tax Act, demanding response within 72 hours.

Malware-laden ZIP attachment 'ITD.zip' on Android accesses SMS, contacts, keystrokes, and overlays fake banking login screens.

On WhatsApp Web, the ZIP delivers a Windows executable for remote access, with payload sizes varying to evade antivirus.

Phishing websites mimic the official e-filing portal to harvest PAN, Aadhaar, passwords, OTPs, and bank details.