Hackers are impersonating the Israel Tax Authority through phishing emails, fake government websites, and CAPTCHA-style checks to trick employees into running SimpleHelp remote access software This article explores hackers impersonating israel. . Observed since September 2026, the activity targets a business task familiar to finance, accounting, and administrative staff.
Unlike CAPTCHA command attacks that prompt users to paste commands into Terminal, this chain uses verification to direct users to a ZIP download followed by an executable launch.
Researchers found eight service records associated with one IP address, including two campaign domains displaying nginx "Coming Soon" pages.
Indicators of compromise (IoCs): - Type: Domain - Indicator: doc-taxes-govil.org - Source: ZIP delivery - Type: Domain - Indicator: document-govil.com - Source: ZIP delivery; blocked request - Type: Domain - Indicator: doc26-govil.org - Source: ZIP delivery - Type: Domain - Indicator: document-govil.online - Source: ZIP delivery - Type: IP - Indicator: 129.121.120.121 - Source: Reported command-and-control address - Type: IP - Indicator: 169.58.239.210 - Source: Reported abused SimpleHelp server - Type: IP - Indicator: 161.97.138.129 - Source: Reported abused SimpleHelp server - Type: URL Fragment - Indicator: Truncated suspected campaign URL - Type: URL Prefix - Indicator: 0d881ad82ddf4ccdb18c8995 document.zip; incomplete - Type: URL Prefix - Indicator: f018003432114393db3bd27a document.exe; incomplete - Type: URL Prefix - Indicator: 6ba34f275f27a2584c7d653f Israel_Tax_Authority.zip; incomplete - Type: URL Prefix - Indicator: 62a25285436c5e34a426613 Hebrew-named executable; incomplete
