Hackers Use Fake Government Websites to Deliver SimpleHelp
Original title: Hackers Use Fake Government Websites and CAPTCHA Checks to Deliver SimpleHelp Remote Access Software
Phishing campaign impersonates Israel Tax Authority to install SimpleHelp remote access software on Israeli targets.
Attackers sent emails posing as the Israel Tax Authority to Israeli organizations. Victims who clicked links reached fake government sites and downloaded an archive containing SimpleHelp client version 5.4.5. The software was pre-configured to connect to attacker-controlled servers. Cato Networks researchers traced the infrastructure but could not confirm MuddyWater attribution. No vulnerability was exploited.
Unconfirmed: Cato Networks suspects MuddyWater connection but cannot confirm it
- Campaign observed since September 2026
- Targets Israeli finance and administrative staff
- Uses Israel Tax Authority impersonation
- SimpleHelp confirmed as version 5.4.5
Impact: unauthorized remote system access
- Vendors
- SimpleHelp
- Victims
- Israeli organizations
- Organizations
- Cato Networks
- Countries
- Israel
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | doc26-govil.org | n document-govil[.]com ZIP delivery; blocked request Domain doc26-govil[.]org ZIP delivery Domain document-govil[.]online ZIP delivery |
| domain | docs.templateoption | ]129 Reported abused SimpleHelp server URL fragment https://docs[.]templateoption Truncated suspected campaign URL SHA-256 prefix 0d881ad82 |
| domain | doc-taxes-govil.org | Type Indicator or source fragment Role or limitation Domain doc-taxes-govil[.]org ZIP delivery Domain document-govil[.]com ZIP delivery; bl |
| domain | document-govil.com | limitation Domain doc-taxes-govil[.]org ZIP delivery Domain document-govil[.]com ZIP delivery; blocked request Domain doc26-govil[.]org ZI |
| domain | document-govil.online | locked request Domain doc26-govil[.]org ZIP delivery Domain document-govil[.]online ZIP delivery IP 129.121.120[.]121 Reported command-and-co |
| ipv4 | 129.121.120.121 | ZIP delivery Domain document-govil[.]online ZIP delivery IP 129.121.120[.]121 Reported command-and-control address IP 169.58.239[.]210 |
| ipv4 | 161.97.138.129 | ss IP 169.58.239[.]210 Reported abused SimpleHelp server IP 161.97.138[.]129 Reported abused SimpleHelp server URL fragment https://do |
| ipv4 | 169.58.239.210 | P 129.121.120[.]121 Reported command-and-control address IP 169.58.239[.]210 Reported abused SimpleHelp server IP 161.97.138[.]129 Rep |
From the original article
3 min read at cybersecuritynews.com
Hackers are impersonating the Israel Tax Authority through phishing emails, fake government websites, and CAPTCHA-style checks to trick employees into running SimpleHelp remote access software. The campaign targets Israeli organizations and turns an ordinary tax-document request into a possible entry point for unauthorized access. Observed since September 2026, the activity targets a business task familiar […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.