[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-new-packclient-rat-hits-china-and-india-via-fake-tax-emails":10,"sections":45},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":34,"tags":35,"sources":40,"feedback":44,"feedback_at":22,"cost_usd":44,"total_tokens":44},5958,"new-packclient-rat-hits-china-and-india-via-fake-tax-emails","New PackClient RAT Hits China and India Via Fake Tax Emails","A financially motivated hacking group is spoofing tax authorities to plant a Telegram-sold spy tool, and researchers expect it to spread well beyond Asia.","A new remote access trojan called PackClient is spreading through fake tax audit emails, hitting organizations in China and India.\n\nSince late May 2026, a financially motivated group tracked as TA4922 has been emailing organizations in China and India while posing as local tax authorities, telling recipients to complete a \"self-inspection\" by filling out attached paperwork that is actually a PackClient installer. Once running, the RAT can steal and manage files, open a remote shell, capture screens and desktops, hijack webcams, log keystrokes, and escalate privileges, according to security firm Proofpoint. Proofpoint has tracked TA4922 for longer than this campaign, and says the group has previously hit small and mid sized businesses in Japan, Taiwan, Korea, Singapore, and India, more recently expanding to organizations in Europe and the UK. The firm has not disclosed how many organizations fell for the current campaign or which industries were hit hardest.\n\nThe bigger story is distribution: PackClient is sold openly on Telegram, so it isn't locked to TA4922 - any buyer with access to that channel can deploy it. A RAT with this feature set usually stays exclusive to whoever commissions it, and Proofpoint expects wider adoption, especially against organizations further west, given how cheaply it turns bespoke spyware into a commodity.\n\nTax deadlines make reliable phishing bait every year, but a capable spy tool for sale on a chat app - deployed by a group with a track record of following its targets westward - is the part worth watching.","[\"packclient\",\"ta4922\",\"phishing\",\"malware\"]","2026-09-01T15:00:00.000Z","2026-09-01T15:57:11.614Z","2026-09-01T15:57:23.543Z","published",null,[24,30],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"Drop or properly qualify the AsyncRAT comparison in the final paragraph — it's presented as established fact ('the same pattern that turned tools like AsyncRAT into background noise') but isn't in the source material and lacks any concrete detail to substantiate the comparison.","resolved",{"id":31,"reviewer":26,"round":32,"reason":33,"status":29},"editor-r2",2,"Fix the historical targeting list — the source explicitly names India as one of TA4922's existing targets (alongside Taiwan, Korea, Singapore) even before 'newer times' Europe\u002FUK expansion, so the draft's framing of India as part of a new 'expansion' pattern contradicts the source and should be corrected.","security",[36,37,38,39],"packclient","ta4922","phishing","malware",[41],{"name":42,"url":43},"TechRadar","https:\u002F\u002Fwww.techradar.com\u002Fpro\u002Fsecurity\u002Fcareful-when-filing-your-taxes-this-new-packclient-malware-is-hitting-global-firms-via-tax-audit-lures",0,{"sections":46},[47,52,56,61,66,71,76,81,86,91,96,101,106,111],{"name":48,"slug":49,"count":50,"latest_published_at":51},"AI","ai",3360,"2026-09-01T20:00:00.000Z",{"name":53,"slug":34,"count":54,"latest_published_at":55},"Security",517,"2026-09-01T21:20:00.000Z",{"name":57,"slug":58,"count":59,"latest_published_at":60},"Policy","policy",260,"2026-09-01T18:19:26.000Z",{"name":62,"slug":63,"count":64,"latest_published_at":65},"Deals","deals",179,"2026-06-29T20:02:07.000Z",{"name":67,"slug":68,"count":69,"latest_published_at":70},"Hardware","hardware",151,"2026-09-01T14:42:22.000Z",{"name":72,"slug":73,"count":74,"latest_published_at":75},"Consumer Tech","consumer-tech",95,"2026-08-18T16:05:00.000Z",{"name":77,"slug":78,"count":79,"latest_published_at":80},"Science","science",91,"2026-08-20T10:01:48.000Z",{"name":82,"slug":83,"count":84,"latest_published_at":85},"Software","software",73,"2026-08-18T07:51:50.000Z",{"name":87,"slug":88,"count":89,"latest_published_at":90},"Dev Tools","dev-tools",69,"2026-08-18T04:00:00.000Z",{"name":92,"slug":93,"count":94,"latest_published_at":95},"Startups","startups",52,"2026-08-25T18:55:12.000Z",{"name":97,"slug":98,"count":99,"latest_published_at":100},"Gaming","gaming",41,"2026-07-09T04:00:00.000Z",{"name":102,"slug":103,"count":104,"latest_published_at":105},"General","general",34,"2026-09-01T13:28:43.000Z",{"name":107,"slug":108,"count":109,"latest_published_at":110},"Reviews","reviews",20,"2026-06-24T12:00:01.000Z",{"name":112,"slug":113,"count":114,"latest_published_at":115},"How-To","how-to",6,"2026-06-16T09:00:00.000Z"]