BENGALURU: Cybercriminals are exploiting the income-tax return (ITR) filing season by sending fake income tax department notices over WhatsApp and other messaging platforms, using forged govt documents, cloned tax portals and malware to steal banking credentials and gain remote access to victims’ devices, according to a report by Bengaluru-based cybersecurity firm CloudSek.The campaign comes at a time when millions of taxpayers are expecting messages related to refunds, notices and compliance deadlines, making them more likely to trust official-looking communications.CloudSek said attackers are using two primary methods: malware-laden WhatsApp attachments and phishing websites that closely mimic the official income-tax e-filing portal.In the WhatsApp campaign, victims receive an “office memorandum” from an unknown or compromised account masquerading as the income tax department. The forged document features govt of India emblem, bilingual English and Hindi text, fabricated reference numbers and the name of a fake tax official to appear authentic.The notice falsely claims that discrepancies have been detected under Sec 271(1)(c) of the Income Tax Act and warns of prosecution under Sec 276C, giving recipients just 72 hours to respond.Instead of including a web link, the message carries a ZIP attachment named “ITD.zip”, presented as tax documents. On Android devices, opening the file installs malware capable of accessing SMS messages, including banking one-time passwords (OTPs), contacts and keystrokes. The malware can also overlay fake login screens on banking and payment applications to capture usernames, passwords, and other sensitive information.In a parallel campaign, fraudsters direct users to websites designed to closely resemble the official income-tax e-filing portal. These fake sites prompt users to enter PAN number, Aadhaar, passwords, OTPs, and bank account details.