Behind the Refund: From GST Phishing to Remcos RAT Through a Multi-Stage .NET Infection Chain

Reported 17 Jul 2026 by otx · Severity: medium

A sophisticated phishing campaign targeting Indian businesses and taxpayers leverages GST-related themes to distribute Remcos RAT through a multi-stage .NET framework. Threat actors impersonate Government of India GST communications using fraudulent refund notifications with conv