Fake LHDN 'Notis Tuntutan Cukai' Is Back, and This Time It Drops Malware

TL;DR

A friend forwarded me a “Notis Tuntutan Cukai & Penalti” that claims to be from LHDN. It threatens a 200% penalty and 3 years in jail unless you submit documents within 72 hours. The “Download Forms” link does not go to hasil.gov.my. It pulls a ZIP from a cloud storage bucket in Hong Kong, and inside is an EXE plus a DLL that 12 AV vendors already flag as a trojan downloader.

If you got this email: don’t click, don’t download, don’t reply, don’t call the number. Report it and delete.

I detonated this only inside Windows Sandbox (disposable VM, no personal data). Please don’t download samples on your daily machine just to “see what happens”.

---

Some context: this template is not new

Back in June 2026, Malaysian news outlets already covered fake LHDN emails using this exact title, the same 72 hour deadline, and fake officer contact details. That wave mostly pushed victims to a fake LHDN website to harvest info (Malay Mail, The Rakyat Post).

The version I’m looking at today reuses the same script but swaps the payload. Instead of a phishing page, the link now delivers malware. Same bait, upgraded hook.

---

Part 1: How the attack works

Stage 0: The email

The scam email as it appears on mobile (personal identifiers redacted)

What the email does to look legit:

Trick	What it looks like	Reality
Fake reply thread	Subject starts with Re :	Makes you think there was an earlier conversation
Authority stack	“KERAJAAN MALAYSIA”, reference number, “Dato’” officer name and title	Copy-paste official vibes, zero verification
Real law, wrong context	Cites Seksyen 106(3), 113(2), 114 of Akta Cukai Pendapatan 1967	Real sections, used to scare. Real penalties don’t arrive as a ZIP
Urgency	72 hours, “tuntutan muktamad sebelum tindakan penguatkuasaan”	Classic pressure to stop you thinking
Fear	Penalty up to 200% + 3 years jail	You panic, you click
Fake contact info	lhdn_compliance@hasil.gov.my, +603-8080 6622	Not LHDN’s official line (LHDN’s hotline is 03-8911 1000, check hasil.gov.my)
Corporate footer	“Think Green…” disclaimer	Looks like every legit office email ever

Also notice it was sent to a support mailbox. That smells like targeting businesses, where some admin or finance person opens every “official” email because that’s literally their job.

Stage 1: The link

Hovering the “Muat turun dokumen” link shows where it really goes

The link text says “Download Forms (LHDN)” but the real target is:

hxxps://lhdn[.]tos-cn-hongkong[.]volces[.]com/SENARAI DOKUMEN2.zip

Breaking that down:

• volces.com is the domain for Volcano Engine (Volcengine), ByteDance’s cloud platform.
• tos-cn-hongkong is their object storage (TOS) in the Hong Kong region.
• lhdn is just the bucket name the attacker picked. Anyone can name a bucket lhdn. It means nothing.

Why use a legit cloud bucket instead of their own domain? Because volces.com has a clean reputation. A lot of email gateways and browser filters won’t block a big cloud provider’s domain, while a freshly registered lhdn-portal-xyz.com would get flagged fast.

Stage 2: The ZIP

Extracted inside Windows Sandbox

Inside SENARAI DOKUMEN2.zip:

File	Type	Size
SENARAI DOKUMEN.exe	Application	223 KB
tedutil.dll	Application extension (DLL)	108 KB

Two red flags right away:

1. A “list of documents” should be a PDF or DOCX, not an Application.
2. Why is there a random DLL sitting next to it?

That EXE + DLL pairing is the signature of DLL sideloading.

Stage 3: DLL sideloading (the sneaky part)

Quick explainer for the non-RE folks:

When a Windows program needs a DLL, it searches in a certain order, and the program’s own folder is usually checked first. So if an app expects tedutil.dll and finds one right beside it, it loads that one, no questions asked.

Attackers abuse this by:

1. Taking a legit (often digitally signed) EXE that expects a certain DLL.
2. Renaming it to something innocent like SENARAI DOKUMEN.exe.
3. Dropping their malicious DLL with the expected name next to it.

The victim double-clicks what looks like a document, the “legit” EXE runs, and it loads the attacker’s DLL. Because the process itself may be a trusted, signed binary, some security tools are less suspicious of it.

I haven’t fully confirmed which legit program the EXE originally is. Next step is checking its digital signature and import table. I’ll update this post once I’ve pulled that apart.

Stage 4: What the DLL actually is

VirusTotal: 12/71 vendors flagged tedutil.dll

VirusTotal results for tedutil.dll:

• Detection: 12/71
• Popular threat label: trojan.yogi/r799992
• Categories: trojan, adware, downloader
• Notable detections: ESET flags it as Win64/TrojanDownloader.Agent, BitDefender and friends as Gen:Variant.Yogi.84962, Elastic as malicious (moderate confidence)
• 64-bit PE DLL, ~107.5 KB

The key word is downloader. This DLL is most likely a first stage: its job is to get a foothold and pull down the real payload from the attacker’s server. That second stage could be anything: an infostealer that grabs your saved browser passwords and session cookies, a RAT for remote control, or access that gets sold to someone else.

Only 12/71 detecting it is also a reminder: a clean VirusTotal result doesn’t mean safe, especially for fresh samples.

The full chain

Fake LHDN email (fear + 72h urgency)
        │
        ▼
"Download Forms" link → ZIP on Volcengine cloud bucket (HK)
        │
        ▼
SENARAI DOKUMEN.exe  +  tedutil.dll
        │   (victim double-clicks the "document")
        ▼
Legit EXE sideloads malicious tedutil.dll
        │
        ▼
Trojan downloader fetches next-stage payload
        │
        ▼
Infostealer / RAT / access sold → bank accounts, email, company network

---

Part 2: Why do attackers do this?

1. LHDN is the perfect bait. Almost every working adult and every company in Malaysia deals with LHDN. Nobody wants a tax problem, so people react first and think later.

2. Fear beats logic. 200% penalty, jail, 72 hours. The whole email is designed to push you into “act now” mode before you check anything.

3. It scales. One template, thousands of inboxes. Only a handful of people need to click for it to pay off.

4. Malware > fake website (for them). A phishing page only steals what you type. Malware on your machine can steal everything: saved passwords, browser cookies (which can bypass 2FA), files, and give them a foothold into your company network if it’s a work PC.

5. Evasion is cheap. ZIP files hide the payload from some email scanners, a trusted cloud domain dodges URL blocklists, and DLL sideloading hides behind a legit process. Each trick costs them almost nothing.

6. Business targets pay more. Sending to support@ and similar mailboxes points at companies. One infected office PC can lead to business email compromise, fake invoice fraud, or ransomware.

---

Part 3: Prevention

For everyone

• Check the real sender address, not just the display name. Official LHDN emails come from @hasil.gov.my. Even then, sender addresses can be spoofed, so don’t treat it as 100% proof.
• Hover before you click (or long-press on mobile). If “LHDN” text points to some random cloud bucket, that’s your answer.
• LHDN will not send you a ZIP or EXE to “download forms”. Any official action happens via MyTax, which you open yourself by typing mytax.hasil.gov.my, never through an email link.
• Never call the number in the email. Get the official contact from hasil.gov.my yourself. LHDN hotline: 03-8911 1000.
• Turn on “show file extensions” in Windows (File Explorer → View → Show → File name extensions). Then SENARAI DOKUMEN.exe can’t pretend to be a document.
• Don’t panic. Real enforcement letters don’t give you a 72 hour ultimatum via a download link.

For companies / IT admins

• Enforce and monitor SPF, DKIM and DMARC so spoofed “government” mail gets flagged.
• Block or quarantine archives (ZIP, RAR, 7z, ISO) from external senders, or at least detonate them in a sandbox first.
• Consider blocking or alerting on direct downloads from generic cloud object storage domains that your business doesn’t actually use.
• Use EDR that detects DLL sideloading patterns (signed EXE loading an unsigned DLL from a user Downloads/Temp folder).
• Use AppLocker / WDAC to stop executables running from Downloads, %TEMP% and archive extraction paths.
• Train staff, especially finance, HR and support teams. Use real samples like this one in awareness sessions.

Already clicked and ran it?

1. Disconnect from the network (Wi-Fi off, cable out).
2. From a different, clean device, change passwords for email, online banking and MyTax, and log out all sessions.
3. Run a full scan, but honestly, for a downloader that may have pulled a second stage, reinstalling Windows is the safest option.
4. If it’s a work device, tell your IT team immediately. Don’t hide it, speed matters.
5. If money was lost, call the National Scam Response Centre (NSRC) at 997 as fast as possible.

Where to report

• LHDN phishing: forward to aduan@hasil.gov.my (LHDN Online Security)
• Cyber incidents: MyCERT Cyber999
• The malicious bucket: report to Volcengine’s abuse channel so they can take it down

---

IOCs

URLs are defanged. Don’t refang and visit them.

Type	Value
URL	hxxps://lhdn[.]tos-cn-hongkong[.]volces[.]com/SENARAI DOKUMEN2.zip
Filename	SENARAI DOKUMEN2.zip
Filename	SENARAI DOKUMEN.exe (223 KB)
Filename	tedutil.dll (108 KB)
SHA256 (tedutil.dll)	e6fd05df6ddb9ccf1dffabcaddae32878685c8357bdec3698e50aa81ca237915
Email (lure)	lhdn_compliance@hasil.gov.my (claimed in body)
Phone (lure)	+603-8080 6622
Subject	Re : / NOTIS TUNTUTAN CUKAI & PENALTI

MITRE ATT&CK mapping

Technique	ID
Phishing: Spearphishing Link	T1566.002
Stage Capabilities: Upload Malware (cloud bucket)	T1608.001
User Execution: Malicious File	T1204.002
Masquerading (EXE named as document)	T1036
Hijack Execution Flow: DLL Side-Loading	T1574.002
Ingress Tool Transfer (downloader)	T1105

---

Key Insights

• Scammers recycle templates. The June 2026 “Notis Tuntutan Cukai” wave came back with a malware payload instead of a fake site.
• Legit cloud storage is now a favourite hosting spot because it dodges reputation filters.
• “Document” that’s actually an EXE + DLL = DLL sideloading. Always.
• Low VirusTotal detection on a new sample doesn’t mean it’s safe.

Tools Used

• Windows Sandbox (safe detonation / extraction)
• VirusTotal
• Browser hover / link inspection

Lesson Learned

The scariest part of this email isn’t the malware, it’s how normal it looks to someone who isn’t in security. Forward this to your parents, your office group chat, your mak cik yang selalu forward mesej. That’s honestly the best defence.

Stay safe, stay paranoid. Happy Hacking!