SyncFuture Phishing Campaign in India Weaponizing Enterprise Security Software for Espionage

Threat researchers reported an espionage-focused phishing operation dubbed SyncFuture targeting individuals in India by impersonating the country’s Income Tax Department. Victims were lured with urgent “tax penalty/compliance” notices (including distribution via SendGrid in some cases) that delivered a ZIP archive masquerading as a government document review tool; opening it launched a multi-stage infection chain designed to establish long-term access. Analysis attributed the discovery to eSentire’s Threat Response Unit, which documented the use of DLL side-loading with legitimate Microsoft-signed applications, privilege escalation via a COM-based UAC bypass, and process masquerading (e.g., appearing as explorer.exe) to reduce detection.

The campaign also demonstrated notable defense evasion by abusing trusted software and user interaction: it leveraged Microsoft-signed binaries and ultimately deployed a legitimate enterprise management/security platform repurposed as the final payload for persistent remote control and surveillance, described as a commercial-grade Chinese IT management tool used for spying. Researchers also observed an unusual technique to evade Avast Free Antivirus by simulating mouse movements and clicks to navigate the product UI and disable/evade protections, underscoring a “living off trusted tools” approach rather than relying solely on custom malware components.