Tax Season Phishing Scheme Spreads New PackClient Malware Across Asia

A Chinese-speaking hacking group has spent the past several months running a tax-themed phishing operation against organizations in China and India, using fear of penalties and audits to push victims into installing a previously underdocumented remote access trojan called PackClient. Security researchers at Proofpoint tracked the activity, attributed to a group known as TA4922, across two separate waves in May and July 2026, and the pattern points to a threat actor that is both expanding its reach and drawing on malware bought through Chinese-language marketplaces on Telegram rather than building every tool in house.

What sets this campaign apart from routine phishing is the tooling behind it. PackClient is not a single piece of malware but a modular framework, sold as a kit, that bundles a downloader, a loader, a core RAT module, and a library of plugins, giving buyers a menu of capabilities that range from basic reconnaissance to full credential theft, financial fraud, and even space for follow-on ransomware. Once installed, the RAT can run more than 60 commands over two simultaneous command and control channels, according to Proofpoint’s analysis, which is an unusually high number for a tool still being sold through underground channels rather than developed for a single client.

The dual-country targeting also signals that TA4922 is treating this less as a one-off scheme and more as a repeatable playbook. The group swapped languages, government agencies, and delivery mechanisms between the Chinese and Indian campaigns while keeping the same PackClient payload underneath, which suggests further variants tailored to other tax authorities or regulatory bodies are a realistic possibility. For defenders, that makes the specific lures observed so far a useful baseline rather than a complete list of what to watch for.

How the campaign against Chinese organizations worked

The first wave, which emerged in late May 2026, impersonated the Shandong Provincial Tax Bureau. TA4922 sent emails telling recipients they had been selected for a 2026 tax inspection and claiming they had failed to pay stamp duties on purchase, sale, and lease contracts, a pretext designed to trigger the kind of anxiety that makes people click before they think. Victims were pushed toward a ZIP archive named 数据资料.zip, hosted on an actor-controlled domain, gov12366[.]com, built to look like a legitimate government tax portal.

The infection chain, step by step

Opening the archive launched an executable, 资料数据.exe, that kicked off a multi-stage infection process:

• The first-stage downloader checks whether it has administrative privileges on the machine.
• It drops a DLL, such as xMain.dll, and runs it through rundll32.exe, a legitimate Windows utility, which helps the activity blend in with normal system processes.
• The downloader then fetches an encrypted payload, decrypts it locally, and writes it to disk under a disguised filename, frequently %TEMP%\svchost.exe, mimicking a core Windows process name.
• To persist across reboots, the malware sets a RunOnce registry entry that relaunches the payload automatically.

Proofpoint noted that the combination of a temporary-directory executable and a trusted system binary makes this sequence difficult to flag without dedicated endpoint monitoring, since none of the individual steps looks unusual in isolation.

The pivot to Indian tax authorities

By mid-July, TA4922 had adapted the same underlying PackClient payload for a new audience, sending Hindi-language emails that impersonated the Indian Income Tax Department. These messages accused recipients of underreporting income or failing to disclose foreign assets, again pairing a plausible bureaucratic threat with pressure to act quickly.

A different delivery method, same end goal

Rather than reusing the ZIP-to-EXE pattern from the China campaign, the India-focused emails distributed archives named Tax_Notice_23665.zip and ITDTAX202601987.zip, each containing a mountable IMG disk-image file. Once mounted, the image revealed a legitimate-looking executable alongside a malicious DLL, and the attackers used DLL sideloading, a technique that abuses a trusted program to load a harmful library, to run a tool called Donut Loader. That loader was ultimately responsible for installing PackClient on the victim’s device.

Post-compromise activity

Proofpoint observed PackClient-linked traffic reaching out to 64[.]81[.]30[.]99 during one campaign, and to 192[.]252[.]180[.]45 over TCP port 6666 in another. In at least one confirmed intrusion, the attackers installed ManageEngine remote monitoring and management software several hours after the initial infection, a move that suggests an effort to establish more durable, interactive access to the compromised environment rather than a smash-and-grab data theft.

What PackClient can actually do once installed

The PackClientLauncher component downloads the PackClientCore RAT and loads it directly into memory, a technique that helps it avoid leaving obvious files behind for antivirus tools to scan. From there, the malware supports a wide range of malicious functions, including:

Researchers also found that PackClient specifically checks whether Telegram Desktop is installed on the infected machine. A plugin tied to this check may be capable of modifying local Telegram configuration files, which would potentially let attackers intercept or monitor a victim’s private messages, extending the phishing operation’s reach well beyond email and financial data. PackClient stores its own configuration, including command and control servers, ports, campaign identifiers, system UUIDs, and installation timestamps, in the registry path HKCU\SOFTWARE\PackClientConsole.

Detection guidance for security teams

Proofpoint’s findings point to several concrete detection opportunities for organizations concerned about this style of phishing attack. Defenders should watch for rundll32.exe loading DLLs from temporary directories, RunOnce registry entries pointing to %TEMP%\svchost.exe, and processes launched with a svchost.exe –guard argument, which corresponds to a watchdog process that restarts the RAT if it gets terminated.

Security teams should also flag unexpected outbound TCP traffic on port 6666, treat unsolicited tax-themed ZIP or IMG attachments with heightened scrutiny regardless of how official they appear, and investigate any unapproved deployment of remote monitoring and management tools, since attackers have shown a willingness to install legitimate IT software to maintain access.

Indicators of compromise

Note: indicators above are defanged with brackets around periods to prevent accidental resolution. Re-fang them only inside controlled threat intelligence tools such as MISP, VirusTotal, or a SIEM before use.