An email campaign dubbed PAPERMILL is exploiting a legitimate copy of Notepad++, along with a fake tax audit software motif, to deliver VenomRAT malware. Attackers are using a signed executable to evade security filters and deploy a multi-stage malicious payload that’s designed to look innocuous until it’s too late.
Phishing lures tax-audit notices with signed tools
The attack begins with an email that looks like a tax audit notice. The message passes SPF, DKIM, and DMARC checks, making it appear authentic to email systems. Attached is a disk image file (.IMG or.ISO) that, once mounted, offers what seems to be a local drive containing a renamed, legitimately signed Notepad++ executable, along with a counterfeit library and an encrypted data file working together to launch the malicious chain. By using this container approach, attackers bypass Windows’ internet-origin markings, reducing warning prompts. The signed executable itself remains untouched — the trick is to leverage it to load a harmful library placed nearby via DLL sideloading. The malware then decrypts its payload and executes the next phase from memory.
Stealth features and VenomRAT arrival
The loader within checks for signs of sandbox environments—low memory, near-empty free storage, unmoved cursors, or low-resolution displays—and delays or quits if it detects them. If it looks like a normal machine, it seeks admin rights, sets up a RunOnce persistence entry, and drops its components into user profile folders. The final payload is VenomRAT v6.0.3, equipped with data-stealing, file-grabbing, and hidden virtual network computing (HVNC) features. Command-and-control infrastructure is configured to support remote commands that enable account theft, espionage, follow-on intrusion, and other malicious behavior.
Targets and tactics: Indian tax-themed attacks, mirrored playbooks
Evidence suggests the campaign is focused on Indian organizations, using tax-related lures in local languages. Analysts noted similarities with previous threat actors in the Silver Fox ecosystem—especially choice of infrastructure and lure styling—but important differences too, such as the specific loader and host program used. Analysts caution that shared techniques don’t necessarily mean shared identity.
Defensive advice and indicators to watch
Security teams are advised to treat unsolicited tax-audit requests and any unexpected disk-image attachments as high risk—even when emails pass authentication checks. Verifying tax-related requests via known government channels, blocking or closely examining.IMG and.ISO attachments, and investigating mounted drives that appear automatically are key recommendations.
Also worth monitoring are signed programs loading DLLs from writable folders, unfamiliar RunOnce entries in the registry, and suspicious network connections from trusted or mimic processes. Since each injection uses fresh containers, relying solely on file hashes for detection won’t hold up. Instead, defenders should hunt for patterns in library naming, persistence mechanisms, and network behavior to detect compromises early.
This case is a stark reminder that a valid signature doesn’t equate to safety. Attackers are increasingly combining trusted applications, social engineering, signed binaries, and multi-part malware to bypass traditional defenses. Organizations need to sharpen their focus on behavior-based detection: scrutinize file origins, container contents, and execution context rather than just trusting cryptographic seals. Watch for suspicious DLL sideloading, odd registry entries, and untrusted network endpoints—these may be the best early warnings of an attack in progress.
