Trojan malware attack: How fraudsters pose as Tax Dept to siphon off your money 

One of the most popular tactics of fraudsters is to woo the potential victims by offering to give money. And when the money is seen to be given by a government agency, it appears more tempting. This is exactly what is being done via Trojan malware attack where victims are promised an income tax refund.

During this process, the hackers steal your banking details, hack into your phone and get access to your net banking.

The Ministry of Electronics and Information Technology (MEITY) has warned that the customers of 27 banks have already become victims of this phishing attack.

How does it work?

First the phishing website sends an SMS link pretending to be the income tax department website. The victims are then told to fill in some personal details before they are sent a file to download that would complete the verification process.

Once the app opens, the victim is requested to grant permission to access SMS, call logs and contacts. Even if the victim doesn’t give permission to these, the form asks for data including name, PAN, mobile number, Aadhaar, address, date of birth, debit card number, PIN, CVV, bank account number, email address, IFSC code.

After these details are entered, the victim is told that there is a refund pending that could directly be sent to the bank account.

Afterwards when the victim clicks ‘transfer’, an error is shown and asks the user to update. While the fake update screen is shown, the malware in the backend sends the user’s details to the hacker’s system.

Now, the real damage happens at this stage when the hacker generates the mobile banking screen specific to the bank and shows it on the user’s device. The user is then asked to key in the mobile banking details which the attacker captures.

What can you do?

This has come to the notice of MEITY’s Computer Emergency Response Team (CERT) which has apprised the users of the existence of this malware and cautioned them against falling into the trap of hackers.

The malware is believed to be Drinik malware which, in 2016, came as a SMS stealer and later evolved into a trojan that induces users to share important banking details.

And if some customer receives any such suspicious link, they should report to incident@cert-in.org.in.

One must exercise caution before downloading any suspicious links. And remember that any link and mail from a government agency ideally has ‘gov.in’ in the URL.

How to protect yourself from a phishing attack?

1. Any government communication is sent from the official websites which invariably have gov.in.

2. Never trust any website that makes arbitrary claims such as free offers, refunds, cashback at the expense of sharing your data.

3. Regardless of the purpose, you must not share your CVV number, PIN, etc.

4. If a web or SMS link or claims made in the link appear suspicious, exercise your due caution and ask around about it.

5. If you are doubtful, report the incident to incident@cert-in.org.in