ScanMalware.com
Known malicious kitcriticalphishing

Fake Malaysian tax-penalty notice emails: blank pages that silently download a disk-image archive (DLL side-loading, remote-management agent)

family: lhdn-tax-notice-autodownload-kit-2026-10
Short link:scanmalware.com/h/312

Emails posing as Malaysia's Inland Revenue Board (LHDN) send a 'tax claim and penalty notice' whose button leads to a throwaway site. The site shows an empty page and immediately downloads a ZIP or RAR archive named like a tax document or PDF (TAX100_PDF102.zip, PDF1024701.zip, TAX20123710_126.zip). Inside is a disk image holding a signed program and a hidden DLL that the program loads (DLL side-loading), or the installer of a remote-management agent already pointed at the operator's server. The domains are expired names that were bought back and switched to the kit on the day they are used, several new ones a day, among them homescapestaging[.]com, celialinde[.]com, segertribute[.]com, crackdie[.]com, nexmoke[.]com, laifapk[.]com and goezbar[.]com. The same servers also carried an Indian 'challan notice' page that sent visitors to a fake PowerISO download. A match means a page that silently downloads an archive in this kit's way, or a scan of a host on the operator's servers.

Anchors

YARA ruleSilent_AutoClick_Archive_Download_Kit
SMQL queryrun
ip:101.32.164.111 OR ip:43.128.218.147 OR ip:43.134.121.203 OR contacted_host:brendaeverson.com OR contacted_host:crackdie.com OR contacted_host:homescapestaging.com OR contacted_host:icmlip.com OR contacted_host:lazorrera.com OR contacted_host:mohammadinuts.com OR contacted_host:musicmaxentertain.com OR contacted_host:nebihanakca.com OR contacted_host:segertribute.com OR contacted_host:shengshunxin.com OR contacted_host:franzando.com OR contacted_host:laifapk.com OR contacted_host:marincentral.com OR contacted_host:nexmoke.com OR contacted_host:goezbar.com OR contacted_host:mantaoilco.com OR contacted_host:bpeindex.com

Provenance

Added: 2026-10-26 09:48
Rule anchor: the page's own download script, which assigns a relative ./download/ archive path and clicks a hidden link to it as soon as an otherwise empty document loads, so the same page on a new domain still matches whatever the archive is called. Search anchor: the operator's server addresses and its newest hosts.
References:

Sightings (45)Atom feed

HostScanScriptMatchScanned
storber.com240650ba…https://storber.com/#htmlyara2026-10-26 09:45
storber.com240650ba…—query2026-10-26 09:45
nexmoke.com37cb5c92…https://nexmoke.com/#htmlyara2026-10-26 09:45
nexmoke.com37cb5c92…—query2026-10-26 09:45
nebihanakca.com7633107c…https://nebihanakca.com/#htmlyara2026-10-26 09:45
nebihanakca.com7633107c…—query2026-10-26 09:45
marincentral.com4d1b00cc…https://marincentral.com/#htmlyara2026-10-26 09:45
marincentral.com4d1b00cc…—query2026-10-26 09:45
lazorrera.com21a6f4b8…https://lazorrera.com/#htmlyara2026-10-26 09:45
lazorrera.com21a6f4b8…—query2026-10-26 09:45
jaejeon.com4a026f55…https://jaejeon.com/#htmlyara2026-10-26 09:45
jaejeon.com4a026f55…—query2026-10-26 09:45
icmlip.com3721ee50…https://icmlip.com/#htmlyara2026-10-26 09:45
icmlip.com3721ee50…—query2026-10-26 09:45
franzando.com250eac39…https://franzando.com/#htmlyara2026-10-26 09:45
franzando.com250eac39…—query2026-10-26 09:45
mantaoilco.com0d1a1171…—query2026-10-26 09:38
laifapk.comb22517ac…https://laifapk.com/#htmlyara2026-10-26 09:38
laifapk.comb22517ac…—query2026-10-26 09:38
goezbar.com2cabb359…https://goezbar.com/#htmlyara2026-10-26 09:38
goezbar.com2cabb359…—query2026-10-26 09:38
crackdie.combd9dfb9e…https://crackdie.com/#htmlyara2026-10-26 09:38
crackdie.combd9dfb9e…—query2026-10-26 09:38
mohammadinuts.comd6bd2fec…https://mohammadinuts.com/#htmlyara2026-10-26 09:38
mohammadinuts.comd6bd2fec…—query2026-10-26 09:38
shengshunxin.comf0756fb4…https://shengshunxin.com/#htmlyara2026-10-26 09:38
shengshunxin.comf0756fb4…—query2026-10-26 09:38
ecomteck.com9cb96659…https://ecomteck.com/#htmlyara2026-10-26 09:38
ecomteck.com9cb96659…—query2026-10-26 09:38
ccaselma.coma1d8a135…https://ccaselma.com/#htmlyara2026-10-26 09:38
ccaselma.coma1d8a135…—query2026-10-26 09:38
brendaeverson.comed749ee4…https://brendaeverson.com/#htmlyara2026-10-26 09:38
brendaeverson.comed749ee4…—query2026-10-26 09:38
thinnected.com81a4d872…https://thinnected.com/#htmlyara2026-10-26 09:38
thinnected.com81a4d872…—query2026-10-26 09:38
samoliveira.com54e3050f…https://samoliveira.com/#htmlyara2026-10-26 09:38
samoliveira.com54e3050f…—query2026-10-26 09:38
celialinde.com6ff20cfe…https://celialinde.com/#htmlyara2026-10-26 09:38
celialinde.com6ff20cfe…—query2026-10-26 09:38
musicmaxentertain.com19b60d8c…https://musicmaxentertain.com/#htmlyara2026-10-26 09:38
musicmaxentertain.com19b60d8c…—query2026-10-26 09:38
segertribute.com1670e31c…https://segertribute.com/#htmlyara2026-10-26 09:38
segertribute.com1670e31c…—query2026-10-26 09:38
homescapestaging.comb09785e0…https://homescapestaging.com/#htmlyara2026-10-26 09:38
homescapestaging.comb09785e0…—query2026-10-26 09:38