BENGALURU: Cybercriminals are exploiting the income-tax return (ITR) filing season by sending fake income tax department notices over WhatsApp and other messaging platforms, using forged govt documents, cloned tax portals and malware to steal banking credentials and gain remote access to victims’ devices, according to a report by Bengaluru-based cybersecurity firm CloudSek.