A newly observed phishing campaign has been targeting finance and administrative personnel in Israeli organizations since September 2026. Attackers impersonate the Israel Tax Authority by sending emails that redirect recipients to counterfeit government websites. These sites use CAPTCHA-style verification to trick users into downloading a ZIP archive that contains a malicious executable masquerading as a tax document. Once run, the file installs SimpleHelp remote access software configured to communicate with attacker-controlled infrastructure.
How the Scam Unfolds
The attack begins with an email claiming to be from Israel’s tax agency. It urges recipients to access their personal account through a link that leads to a look-alike website — complete with domain names that mimic official government subdomains. Visitors are presented with a checkbox, password prompt, and a “Continue” button, all designed to mimic document verification workflows. These details feed into a social engineering scheme rather than any bona fide process.
Once someone downloads the ZIP archive and opens it, they’ll find an executable. The file often carries a Hebrew name meaning “Israel Tax Authority” to deepen the illusion. When run, it installs SimpleHelp, a legitimate remote support tool. While the software itself isn’t malicious, in this context it’s repurposed: it can allow someone to control desktops, access terminals, move files, or run commands, depending on how it’s configured.
Investigation and Attribution
Security researchers observed this campaign’s infrastructure and delivery method, attributing parts of its style to the MuddyWater group. However, they warn that similarities in tools and targets aren’t enough to definitively tie the attack to that group. Evidence comes from telemetry and observations such as the timing, artifact overlap with previous attacks, and Israel-focused targeting. That said, there’s no proof that SimpleHelp’s software itself has vulnerabilities exploited, nor that its servers have been compromised.
The samples analyzed all used SimpleHelp Remote Access Client version 5.4.5, though older versions. Investigation uncovered several IP addresses and domain names associated with campaign infrastructure. Tasks such as FOFA searches revealed eight service records tied to one IP, some of which hosted “Coming Soon” pages under nginx. Yet researchers emphasize that finding these records doesn’t equal confirmation of additional compromised servers or victims.
Indicators of Compromise to Monitor
Security teams have been given a list of IoCs to watch for, including several suspicious domains and IPs. Domains used to distribute the ZIP archives include names like doc-taxes-govil[.]org, document-govil[.]com, doc26-govil[.]org, and document-govil[.]online. IPs tied to the campaign include those reported as remote access servers and command-and-control endpoints. Hashes of the archive contents like the ZIP and executable file names with Hebrew terms also feature in the public IoC list. These indicators are defanged to prevent accidental activation when testing detection systems.
On October 20, 2026, the campaign was officially disclosed to SimpleHelp, which confirmed the versions involved and asserted that the abuse came from adversarial configuration of genuine software instances—rather than exploiting a newly discovered bug.
The attack sheds light on a broader trend: adversaries misusing legitimate remote management tools (RMM) to gain initial access, rather than relying on direct exploitation vulnerabilities or zero-days. By deploying trusted software, attackers can evade detection more easily, especially in environments where RMM tools are sanctioned for remote support.
What to watch going forward: Organizations need sharper phishing awareness, especially around document requests that push executable downloads. Monitoring network telemetry for the listed domains and IP addresses is critical. Also worth noting: while no data breach or confirmed post-install activity has been observed yet, the potential for remote sessions or data exfiltration remains real. Adversaries often wait before making their next move.
