Cruciferra: The Malware-Hiding Service Fuelling Attacks on Indian Taxpayers

Key points

• A China-linked cybercrime group is using tax-themed phishing emails to target Indian taxpayers, accountants and corporate finance teams.
• The gang hides its malware using a paid service called Cruciferra, according to research by Proofpoint.
• Cruciferra is a crypter, a tool that scrambles malware so antivirus software cannot recognise it.
• Multiple unrelated criminal crews are paying for Cruciferra to deliver remote-access trojans, malware that hands attackers full control of a victim's computer.
• The technique uses two tricks known as BYOVD and process ghosting to bypass Windows defences.

A China-linked criminal group has been caught running tax-themed phishing attacks against people in India, paying for a specialist service to keep its malware invisible to antivirus tools.

The service is called Cruciferra. It is a crypter: a piece of software that wraps malware in layers of disguise so security products can't spot it. Think of it as a laundry service for computer viruses.

The findings come from a new analysis by security firm Proofpoint, reported first by The Hacker News. We first reported on fake tax emails targeting Indian finance staff on 6 July 2026, when a suspected Chinese group was already posing as India's Income Tax Department.

Who is being targeted?

Indian taxpayers, tax professionals and corporate finance staff. The attackers send emails dressed up as income tax notices, the kind of message an accountant or payroll clerk would open without thinking twice.

Once someone clicks, the malware installs quietly. Attackers gain remote control of the machine, which on a finance team's laptop means access to bank logins, tax filings and payroll data.

What is Cruciferra and why does it matter?

Cruciferra is a paid tool that criminals rent to hide their malware. Proofpoint says several unrelated criminal crews are all using it, which is why the same evasion tricks keep showing up across otherwise unconnected attacks.

The tool delivers remote access trojans, malware that gives an attacker the same control over your PC as if they were sitting at the keyboard.

Two techniques stand out.

The first is BYOVD, short for Bring Your Own Vulnerable Driver. Attackers install a legitimate but flawed Windows driver, a small piece of trusted software that talks to hardware, then abuse its known weakness to switch off antivirus protections from the inside.

The second is process ghosting. Malware runs on a computer while leaving almost no trace, because the file it started from has already been deleted before Windows notices.

Both tricks are designed to defeat the defences most companies rely on.

What does this look like in practice?

Cruciferra isn't one gang's private weapon. It's a product sold into the criminal market, which means today's tax scam in Mumbai and tomorrow's payroll attack somewhere else may share the same fingerprint under the hood.

Should ordinary people worry?

If you file taxes in India or handle finances at work, treat unexpected tax emails with suspicion. Real tax authorities don't send attachments demanding urgent action. When in doubt, log in to the official tax portal directly through your browser rather than clicking any link.

Finance teams should assume a convincing tax email will land in someone's inbox this filing season. Someone will click.

Common questions

Is my antivirus enough to stop this?

Not on its own. Cruciferra is built specifically to slip past traditional antivirus. Layered defences and prompt patching both matter, and so does staff awareness.

What is a remote access trojan?

It's malware that gives an attacker full remote control of your computer, letting them read files and capture passwords.