A lure built around Indian tax assessment and penalty pages is being used to push Windows users toward a download chain that turns an “official” file into malware risk.