In December 2025, Kaspersky, a cyber security company, detected a wave of malicious emails which very closely resembled official emails from the Income Tax Department of India. A few weeks later, in January 2026, a similar campaign began targeting Russian organisations. After that the same campaign was launched in Indonesia.
Kaspersky says that this malicious email is an ‘APT’ (Advanced Persistent Threat) campaign, disguising malicious files as documents related to tax violations. Upon infection, attackers could gain remote access to affected devices and exfiltrate sensitive data.
