Reported by 2 outlets
Chinese Hackers Deploy PackClient RAT via Tax-Themed Phishing Attacks to Steal Data
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 1.00 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.55 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Chinese Hackers Deploy PackClient RAT via Tax-Themed Phishing Attacks to Steal Data
gbhackers.com · 45d ago · August 29th, 2026
A Chinese-speaking threat actor tracked as TA4922 is deploying the PackClient remote access trojan via tax-themed phishing campaigns targeting organizations in mainland China and India. The activity, observed by Proofpoint in May and July 2026, demonstrates the group’s expanding initial-access capabilities and the increasing availability of sophisticated malware on Chinese-language Telegram marketplaces. PackClient is a […] The post Chinese Hackers Deploy PackClient RAT via Tax-Themed Phishing Attacks to Steal Data appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from cyberpress.org
TA4922 Hackers Use Tax Phishing to Deploy PackClient RAT Across Asia
cyberpress.org · 46d ago · August 29th, 2026
Proofpoint researchers observed the group targeting organizations in mainland China and India during May and July 2026, using impersonated tax-authority notices to pressure recipients into opening malicious archives. The activity signals an expansion of TA4922’s initial-access toolkit and highlights the growing availability of sophisticated malware in Chinese-speaking cybercrime marketplaces. TA4922 Hackers Use Tax Phishing PackClient provides operators with data-theft, surveillance, remote control, payload delivery, and persistence capabilities, making it suitable for espionage, financial crime, reconnaissance, or follow-on ransomware operations. The first campaign, detected in late May, impersonated the Shandong Provincial Tax Bureau . Emails warned recipients that their organizations had been selected for a 2026 tax inspection and allegedly failed to pay stamp duties on purchase, sales, and lease contracts. Victims were directed to download a ZIP archive named 数据资料.zip from the actor-controlled domain gov12366[.]com . The archive contained an executable, 资料数据[.]exe , which initiated the PackClient infection chain. The malware’s first-stage downloader checks whether it has elevated privileges, drops a DLL such as xMain.dll , and invokes it through rundll32.exe . Tax Phishing (Source: