Loading story…
Security researchers reported multiple U.S.-focused phishing campaigns that used tax-themed lures to trick victims into opening password-protected ZIP archives and malicious Windows shortcut (.lnk) files. Microsoft said the activity targeted accounting, tax preparation, CPA, bookkeeping, and financial services firms, with emails posing as client tax documents and using AWS click-tracking links at awstrack[.]me to redirect users to hosted ZIP files. Securonix separately described a related campaign it tracks as TACTICAL#OCTOPUS, which used similar tax-season themes and staged lure PDFs to infect victims.
The infection chains relied on .lnk files to launch PowerShell and VBScript, retrieve additional MSI, DLL, EXE, and PDF payloads, and in some cases use GuLoader/CloudEyE to execute shellcode and deliver Remcos or other malware directly in memory. Securonix said newer samples shifted from encoded IP-based URLs to public redirect services such as rebrand.ly, while payloads used process injection into Internet Explorer utilities including ieinstal.exe and ielowutil.exe to evade detection. Researchers said the resulting compromises enabled remote access, keystroke logging, clipboard capture, information theft, and potential lateral movement, with observed command-and-control infrastructure including 5.8.8.100, 109.206.240.67, and 194.180.48.211.
Get the infrastructure and lures behind it.
6 events from the most recent confirmed update back to the earliest known activity.
Securonix published research on TACTICAL#OCTOPUS, detailing tax-themed phishing against U.S. victims, the PowerShell/VBScript infection chain, GuLoader use in newer samples, and command-and-control infrastructure including Russian-registered IP space. The company said Russian origins were possible but attribution remained unconfirmed.
Microsoft publicly reported the Tax Day-themed phishing campaign and described how it delivered Remcos through Hightail-hosted ZIP files, malicious LNKs, and follow-on payloads including MSI, DLL, executable, VBScript, PDF, and sometimes GuLoader stages. The company also shared detections, indicators, and mitigation guidance.
An April 2023 update noted that newer TACTICAL#OCTOPUS samples moved from encoded IP-address URLs to public redirect services such as rebrand.ly. In the updated chain, samples directly downloaded and executed GuLoader/CloudEyE, which then hollowed into ieinstal.exe or ielowutil.exe after a short delay.
Microsoft observed a phishing campaign beginning in February that targeted accounting, tax preparation, CPA, bookkeeping, and financial services organizations with U.S. Tax Day-themed lures. The campaign used client-tax-document pretexts, AWS click-tracking links, ZIP archives, malicious LNK files, and in some cases GuLoader to deliver Remcos.
Securonix tracked an ongoing phishing and malware campaign it calls TACTICAL#OCTOPUS that targeted U.S. victims during the 2023 tax season using tax-themed emails and password-protected ZIP attachments. The infection chain relied on malicious LNK files, PowerShell and VBScript stages, and in-memory execution via Internet Explorer-related processes.
By the time of Securonix's reporting, the rebrand.ly redirect URLs used in the TACTICAL#OCTOPUS campaign had been blocked by the redirect service. This followed the campaign's shift to using public redirectors in newer samples.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 94 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
5 references tracked. Mallory keeps watching after this page renders.
securonix.com
Open sourcemicrosoft.com
Open sourcecrowdstrike.com
Open sourceforensicitguy.github.io
Open sourcecrowdstrike.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft reported a wave of tax-season phishing campaigns targeting primarily U.S. organizations and individuals, using **IRS-themed lures**, fake tax documents, QR codes, malicious attachments, and abused legitimate services to steal credentials or deploy malware. One campaign attributed to **Storm-0249** used IRS-themed emails and counterfeit **DocuSign** pages to deliver **BruteRatel C4** and later **Latrodectus**, while other activity used QR-code PDFs to direct victims to **RaccoonO365** credential-harvesting pages, malicious Excel macros to install **AHKBot**, and tailored outreach to accountants to deliver **GuLoader** and **Remcos**. The activity shows attackers exploiting tax filing urgency and trust in government communications to compromise users and enterprise environments. Microsoft published indicators and mitigation guidance including **MFA**, phishing-resistant authentication, Safe Links, network protection, and Defender detections, while the **IRS** continues to direct the public to report fake IRS, Treasury, or other tax-related emails and messages through its phishing reporting channels.
Aug 15, 2026
Attackers distributed remote-access malware through two distinct delivery chains: a fake **FileZilla** website serving trojanized installers and phishing emails impersonating South Korea’s **National Tax Service**. In the FileZilla campaign, victims received either a portable archive containing a malicious `version.dll` for DLL sideloading or a bundled installer that deployed legitimate FileZilla alongside a rogue DLL in the install path. The malware acted as a multi-stage loader, decrypting payloads in memory before launching a RAT that could steal credentials, log keystrokes, capture screenshots, and provide **HVNC**-based remote control. The operators also used DNS-over-HTTPS to Cloudflare’s resolver to look up `welcome.supp0v3[.]com`, likely to reduce visibility to DNS-based defenses, and included anti-analysis checks for VMware and VirtualBox environments. In the tax-themed campaign, recipients were lured to spoofed tax-notice pages and prompted to download a ZIP archive containing a legitimate signed Intel executable, a malicious sideloaded DLL, and an encrypted `BIN` payload. The malware decrypted shellcode and a RAT/backdoor from `vulkan-1.bin` using a modified RC4 routine, then established persistence through a service named **"Microsoft Compatibility system"**. Researchers said the backdoor supports remote control, privilege escalation, process injection, file theft, and lateral movement over RPC. Infrastructure analysis linked the activity to multiple variants and multilingual lures, including impersonation of tax and court authorities in Malaysia and India, indicating an organized, evolving multi-country operation.
Jun 29, 2026
Multiple campaigns are using phishing emails and archive-based lures to deliver remote access malware through stealthy, multi-stage infection chains. Point Wild documented **Remcos RAT**, **DesckVB RAT**, and a Rust-based **COVERT RAT** being delivered through ZIP attachments, weaponized `LNK` files, obfuscated JavaScript droppers, and hidden PowerShell execution, often with decoy documents to mask activity. The payloads were loaded filelessly through .NET reflection and in-memory execution, with operators abusing legitimate binaries and services such as `aspnet_compiler.exe`, GitHub, and paste or web-hosting platforms to stage malware while evading detection. Reported command-and-control infrastructure included `192.3.27.141:8087`, `172.245.246.77:8080`, and `181.231.253.69:4444`, while observed artifacts included `C:\ProgramData\remcos\logs.dat`, `C:\ProgramData\colors\logs.dat`, and payload names such as `ALTERNATE.dll`, `ClassLibrary3.dll`, `Keylogger.dll`, and `msedge_proxy.exe`. Separate reporting showed the same tradecraft extending beyond custom RATs to commodity remote-access software and credential theft. A campaign targeting Russian aerospace and aviation organizations used invoice-themed phishing and spoofed domains to install a portable **AnyDesk** instance for unattended access, maintain persistence with a scheduled task, minimize visibility with Tray Minimizer, and exfiltrate configuration data through a command-line SMTP mailer; Seqrite linked the activity to **Rare Werewolf (Librarian Ghouls)**. Securonix research cited by Trojan Killer described **VEIL#DROP** using fake document-style JavaScript files, Blogspot-hosted staging, PowerShell download cradles, XOR decoding, and in-memory .NET loading to deploy **PureLog Stealer**, which targets browser credentials, cookies, session tokens, wallet data, and host information. Across the campaigns, the common pattern is phishing-led initial access followed by LOLBins, PowerShell, staged downloads, persistence, and covert data theft or long-term remote control.
Jul 12, 2026