PAPERMILL Hackers Abuse Signed Notepad++ to Deploy VenomRAT in Tax Audit Attacks

A phishing campaign using a fake tax-audit notice is deploying VenomRAT through a signed copy of Notepad++. The operation, tracked as PAPERMILL, uses an email and a disk-image attachment to make a dangerous file look routine.

The attachment arrives with a tax-audit themed subject and can pass SPF, DKIM and DMARC checks. Opening it mounts what appears to be a local drive, allowing the malicious chain to start without warning labels carried by files downloaded from the internet.

Analysts at JUMPSEC identified the activity after reviewing a suspicious client email. They assessed PAPERMILL as an emerging cluster with tradecraft similar to the Silver Fox ecosystem, while stopping short of attributing it to that group.

JUMPSEC said in a report shared with Cyber Security News (CSN) that the campaign illustrates why a valid signature is not proof that an entire file set is safe.

It combines a familiar lure, a trusted application, a booby-trapped supporting file and an encrypted final payload, helping attackers slip past basic security controls. This approach complicates incident investigation and response for defenders.

PAPERMILL Hackers Abuse Signed Notepad++

The email directs recipients to a tax-notice-themed disk image. Once mounted, the container presents a renamed, legitimately signed application, a counterfeit library and an encrypted data file.

This technique can strip the internet-origin mark from the files inside, reducing the warnings Windows would normally display. The signed executable has not been altered. Instead, it is renamed and made to load the nearby malicious library.

This form of DLL sideloading lets harmful code run beside a trusted process, a pattern also seen in recent DLL sideloading campaigns.

The rogue DLL exposes only the functions the legitimate program expects, allowing the application to open normally while the loader works in the background.

It also uses misleading section names intended to confuse analysis tools, then decrypts its data file and launches the next stage from memory.

The loader checks whether the device resembles an automated analysis environment. Low memory, little free storage, a short uptime, an unmoved cursor or a low display resolution can trigger a five-minute delay rather than an immediate exit.

VenomRAT delivery and defensive steps

After the delay and privilege checks, the loader can seek administrator approval, create a RunOnce persistence entry and copy components into user-profile folders.

It then uses a Donut shellcode loader to run a .NET payload in memory. That layered design mirrors the disk-image VenomRAT delivery technique, but PAPERMILL adds a signed-program sideloading stage.

The recovered configuration identifies VenomRAT version 6.0.3 with hidden virtual network computing, data-stealing and file-grabbing capabilities.

Its server is configured for remote command traffic, creating a risk of account theft, surveillance and follow-on intrusion if a victim launches the attachment. Related samples and infrastructure suggest a campaign focused on Indian tax-themed targets.

Researchers found links to the broader Silver Fox-style playbook, including China-connected infrastructure and tax lures, but noted key differences in the chosen host program, loader and remote-access tool.

That caution matters: a shared technique can point to an ecosystem or copycat activity, rather than prove that one named actor ran the campaign.

Organizations should treat unsolicited tax notices and unexpected disk-image files as high risk, even when an email passes authentication checks.

Staff should independently verify tax-related requests through known channels, while security teams should block or closely inspect IMG and ISO files delivered by email and investigate unusual mounted drives.

Defenders should also alert on signed applications loading unexpected DLLs from user-writable folders, unfamiliar RunOnce entries and suspicious network connections from trusted or system-lookalike processes.

These controls complement lessons from SilverFox trusted software abuse and can expose the behavior that per-download file hashes may miss.

Because PAPERMILL can generate fresh containers, hashes alone are unlikely to provide durable coverage. Hunting for loader file relationships, library naming patterns, persistence locations and command traffic gives responders stronger ways to find infections and contain them before attackers expand access.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC