Could A Fake Tax Email Infect Your System? Kaspersky Flags New ABCDoor Malware

Kaspersky has attributed a global phishing campaign to the SilverFox threat group, which allegedly used fake tax-related emails to distribute malware and a newly identified Python-based backdoor named ABCDoor.

According to the cybersecurity firm, the campaign began in December 2025 with emails in India that closely mimicked notices from the Income Tax Department.

Similar phishing attacks linked to the same group later detected in Russia in January, followed by incidents in Indonesia, South Africa and other countries.

The company said it recorded more than 1,600 malicious emails between January and February targeting firms in the industrial, consulting, trade and transportation sectors.

Kaspersky said recipients were urged to download an archive described as a ‘list of tax violations’. Once opened, the archive triggered a modified Rust-based loader sourced from a public repository, which downloaded and executed the ValleyRAT backdoor.

Researchers found ValleyRAT deploying a new plugin functioning as a loader for the previously undocumented ABCDoor malware.

The backdoor allegedly enables attackers to upload or download files and remotely control infected systems by streaming multiple victim screens simultaneously in near real time.

The firm urged organisations to strengthen email defences by automatically blocking suspicious emails, scanning password-protected archives and implementing CDR technology.

A separate cybersecurity report cited by the company warned that credential theft and identity compromise are becoming key entry points for large-scale cyberattacks against Indian IT firms.

The report noted 265.52 million detections across over 8 million endpoints, with Trojans accounting for nearly 43 per cent of detections.

Researchers warned that compromised credentials traded on dark-web marketplaces could allow attackers access to multiple cloud and remote-access environments.

Also Read: Is AI Quietly Reshaping The Tech Workforce? Cloudflare Cuts 1,100 Jobs