Hackers Impersonate Israel Tax Authority to Distribute SimpleHelp Remote Access Tool
A phishing campaign is impersonating the Israel Tax Authority, using fake government websites and CAPTCHA-like verification to trick users into downloading the SimpleHelp remote access software.
Cybercriminals are employing a sophisticated social engineering tactic, impersonating the Israel Tax Authority to deliver the SimpleHelp remote access tool to Israeli organizations. The campaign, observed since September 2026, leverages phishing emails that direct recipients to fake government websites designed to mimic official Israeli web namespaces. These deceptive sites present users with a seemingly legitimate process, including a CAPTCHA-style verification, to download an archive file.
Upon opening the downloaded archive, victims are presented with a file disguised as a tax document. However, this file is actually an executable designed to install the SimpleHelp remote access software. SimpleHelp is a legitimate tool used for remote support, offering features such as desktop control, file transfer, and system diagnostics. When deployed without authorization, these legitimate functionalities can be exploited by attackers to gain unauthorized access to company systems, inspect sensitive data, or deploy further malicious payloads.
The attack chain begins with a phishing email that appears to originate from the Israel Tax Authority. Users who attempt to access their supposed personal account area are redirected to a convincing lookalike website. This site employs a verification interface, including a checkbox and a 'Continue' button, along with an archive password, to legitimize the download process and encourage users to proceed.
Researchers from Cato Networks identified the campaign's infrastructure and noted its reliance on social engineering to bypass security measures. Unlike some attacks that might involve direct exploitation of vulnerabilities, this campaign's primary entry vector is the manipulation of user trust. The attackers aim to persuade employees, particularly those in finance, accounting, and administrative roles, to willingly download and execute the malicious software.
While the exact extent of successful compromises remains unclear, Cato Networks reported a blocked request to the campaign's infrastructure, indicating active engagement. The researchers have tentatively linked the campaign to the MuddyWater group, citing similarities in targeting and the use of SimpleHelp in previous operations. However, definitive attribution is not yet established, and the evidence primarily supports suspicion.
SimpleHelp has been notified of the malicious use of its software and confirmed that the samples involved an older release of its Remote Access Client. Importantly, neither SimpleHelp nor Cato Networks found evidence that this campaign exploited any software vulnerabilities in SimpleHelp itself. The focus remains on the social engineering aspect, where legitimate software is weaponized through user deception.
The campaign's infrastructure includes several domains and IP addresses associated with command-and-control (C2) communication and the distribution of the malicious archives. Indicators of compromise (IoCs) have been shared to aid in detection and defense, with a strong emphasis on the social engineering tactics employed. The use of legitimate remote access tools in phishing attacks represents a growing trend, as it allows threat actors to leverage trusted software for malicious purposes, making detection more challenging for security teams.