Indian Taxpayers Targeted by Fake App Distributed by Phishing Actors

  • Taxpayers in India are getting SMS that supposedly come from the Income Tax Department urging them to download a tax-filing app.
  • The app is basically malware serving phishing forms that aim to grab a set of sensitive details from the victim.
  • By accessing the device’s SMS, the actors can steal 2FA codes for compromising the user’s banking account.

As the tax season in India is underway, taxpayers are increasingly targeted by scammers and phishing actors who are looking to exploit the period to steal their sensitive information. In this effort, they have created a new Android malware named ‘Elibomi,’ which serves the victim a fake tax-filing application and then siphons all entered data to the actor-controlled server.

According to McAfee’s Mobile Research team, who discovered this first, the problems start with the arrival of an SMS that pretends to be from the Income Tax Department in India, urging the recipient to download the malware. Upon installation, the app asks for SMS access and use permission, supposedly needed for the verification of the mobile number to the tax agency’s systems. In reality, Elibomi just steals all SMS messages stored in the infected device, along with emails, phone numbers, and any other personal information it can grab.

Source: McAfee

Cyble researchers have dug deeper into the source code of the malicious app and warn that the app could be updated at any time to use a different theme. Currently, it asks for the user’s net banking credentials, banking details, PAN and mobile number, address, name, date of birth, debit card number, expiry date, and even the CVV.

Source: Cyble

By having access to the device’s SMS, the crooks may grab 2FA codes relevant to the net banking account, so they can break through MFA protections. This is another example of why SMS isn’t the best two-factor authentication option.

Source: Cyble

Giving away all of the above info basically opens up a whole set of exploitation potential for the crooks, so if you are worried that you may have been tricked, you have limited time to correct the mistake. Call your card issuer and ask them to invalidate it due to compromise, and then proceed to reset whatever passwords you exposed by voluntarily providing your internet banking credentials.

To uproot Elibomi from your mobile phone, run a trustworthy mobile security tool and perform a full scan on the device’s storage. In the future, avoid tapping URLs that have arrived via SMS, and never trust any app that has been sourced outside the Google Play Store.



Banking Trojan Targets 100 Organizations in Brazil

A banking trojan from Latin America was found targeting almost 100 Brazilian organizations and individuals.The malware was first noticed in late August...

The Number of Phishing Emails Impersonating Craigslist Is Growing

Craigslist Gsuite & Microsoft users are being targeted with phishing emails that present a fake user login page.These emails rely on brand...

Best Buy, Home Depot, and Lowes Drop Surveillance Companies Linked With Uyghur Oppression

Best Buy, Home Depot, and Lowes have decided to pull off the shelves all the security cameras from Lorex and Ezviz.The US...
For a better user experience we recommend using a more modern browser. We support the latest version of the following browsers: For a better user experience we recommend using the latest version of the following browsers: Chrome, Edge, Firefox, Safari