Hackers Use Fake Government Websites and CAPTCHA Checks to Deliver SimpleHelp Remote Access Software

Hackers are impersonating the Israel Tax Authority through phishing emails, fake government websites, and CAPTCHA-style checks to trick employees into running SimpleHelp remote access software.

The campaign targets Israeli organizations and turns an ordinary tax-document request into a possible entry point for unauthorized access.

Observed since September 2026, the activity targets a business task familiar to finance, accounting, and administrative staff.

Instead of receiving a tax document, recipients download an archive containing an executable. The attack reflects broader phishing campaigns abusing RMM tools, where legitimate software becomes a route into company systems.

Researchers from Cato Networks identified the campaign’s delivery infrastructure and examined its use of SimpleHelp.

In their November 3 research report, Cato CTRL researchers said they suspect a connection to MuddyWater, although the evidence does not establish definitive attribution. CyberIL had previously reported the activity.

Hackers Use Fake Government Websites and CAPTCHA Checks

The attack starts with an email claiming to come from the Israel Tax Authority. Recipients who try to enter the supposed personal account area reach a lookalike website.

Its government-themed name creates a misleading connection to Israel’s official government web namespace. The page then presents a checkbox, a Continue button, and an archive password.

These details make the download resemble a protected document service. Unlike fake CAPTCHA command attacks that instruct victims to paste commands into Terminal, this chain uses verification to lead users toward a ZIP download and subsequent executable launch.

Inside the archive, the supposed tax document is actually a program. One sample carries a Hebrew filename meaning “Israel Tax Authority,” extending the impersonation beyond the browser.

Opening it can deploy SimpleHelp configured to connect to infrastructure controlled by the attackers. SimpleHelp is legitimate remote support software, not inherently malware.

Its normal features include desktop control, terminal access, file transfers, and system diagnostics. When deployed without authorization, those same functions could let an operator inspect business systems, run commands, retrieve files, or deliver additional tools.

The distinction between capability and observation matters. Cato described these functions as potential attacker uses, not confirmed actions in this campaign.

Its telemetry showed a blocked request to campaign infrastructure, rather than proof that an attacker completed a remote-access session or stole information.

Suspected MuddyWater Links and the Limits of the Evidence

Cato’s attribution assessment rests on Israeli targeting, locally tailored impersonation, and phishing that delivers legitimate remote-access software.

Earlier MuddyWater remote access operations also involved SimpleHelp, providing relevant context. However, similarities in tools and targeting support suspicion rather than conclusive identification of the operator.

The infrastructure investigation also used FOFA searches for two HTTP ETag values. Researchers found eight service records associated with one IP address, including two campaign domains displaying nginx “Coming Soon” pages.

Those eight records should not be mistaken for eight separate servers or confirmed victims. Cato notified SimpleHelp on October 20, 2026, and shared server information the following day.

SimpleHelp identified both samples as Remote Access Client version 5.4.5 and assessed the findings as apparent malicious use of an older release. Neither party identified evidence of a software vulnerability being exploited.

That separates this campaign from earlier SimpleHelp vulnerability exploitation incidents involving compromised remote-management deployments.

Here, the documented entry point was social engineering intended to persuade users to install an attacker-configured client. Cato also found no evidence that SimpleHelp’s own infrastructure had been compromised in connection with this activity.

Indicators of compromise (IoCs):-

Type	Indicator or source fragment	Role or limitation
Domain	doc-taxes-govil[.]org	ZIP delivery
Domain	document-govil[.]com	ZIP delivery; blocked request
Domain	doc26-govil[.]org	ZIP delivery
Domain	document-govil[.]online	ZIP delivery
IP	129.121.120[.]121	Reported command-and-control address
IP	169.58.239[.]210	Reported abused SimpleHelp server
IP	161.97.138[.]129	Reported abused SimpleHelp server
URL fragment	https://docs[.]templateoption	Truncated suspected campaign URL
SHA-256 prefix	0d881ad82ddf4ccdb18c8995	document.zip; incomplete
SHA-256 prefix	f018003432114393db3bd27a	document.exe; incomplete
SHA-256 prefix	6ba34f275f27a2584c7d653f	Israel_Tax_Authority.zip; incomplete
SHA-256 prefix	62a25285436c5e34a426613	Hebrew-named executable; incomplete

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.