Chinese attackers use fake tax emails to steal data
A Chinese-speaking hacking group called TA4922 is sending fake tax warning emails to organizations in China and India. Opening the attached file installs a spyware program called PackClient that can steal data, log keystrokes, and take screenshots from the infected computer.
- Report priority
- Medium
- Targets
- TA4922+1 more
How it works
- The emails threaten unpaid taxes or unreported income and push the recipient to open an attached archive.
- Inside is a program that quietly installs a spyware tool called PackClient, which then lets the attacker take over and monitor the computer.
What to do
If your organization received an unexpected tax-inspection email with a ZIP or disk-image attachment claiming to be from a tax authority, especially one impersonating the Shandong Provincial Tax Bureau or the Indian Income Tax Department in May or July 2026, do not open unsolicited tax-notice attachments, verify inspection notices directly with the tax authority through its normal update channel or phone line, and have IT security teams watch for rundll32.exe loading files from temp folders or unexpected RunOnce registry entries.
Technical details
Affected software: TA4922, PackClientLauncher
An organization in China receives an email claiming the government tax bureau selected it for an inspection over unpaid stamp duty. The email tells the recipient to download a ZIP file from a fake tax-service website and open the program inside. That program checks for admin rights, quietly installs a hidden file disguised as a normal Windows process, and sets it to run every time the computer restarts, giving the attacker remote access to the machine.
TA4922 delivers PackClient, a modular RAT sold on Telegram, through tax-themed lures. The China wave used a ZIP with an EXE that drops xMain.dll, runs it via rundll32.exe, decrypts a payload to %TEMP%\svchost.exe, and sets RunOnce persistence. The India wave used mounted IMG disk images and DLL sideloading to launch Donut Loader, which installs PackClient.
PackClientCore runs in memory with two C2 channels and over 60 commands covering file access, screenshots, webcam and keystroke capture, browser data theft, and proxy tunneling. Observed C2 hosts include 64.81.30.99 and 192.252.180.45 on TCP 6666; one intrusion added ManageEngine RMM software for expanded access.