Loading story…
Microsoft reported a wave of tax-season phishing campaigns targeting primarily U.S. organizations and individuals, using IRS-themed lures, fake tax documents, QR codes, malicious attachments, and abused legitimate services to steal credentials or deploy malware. One campaign attributed to Storm-0249 used IRS-themed emails and counterfeit DocuSign pages to deliver BruteRatel C4 and later Latrodectus, while other activity used QR-code PDFs to direct victims to RaccoonO365 credential-harvesting pages, malicious Excel macros to install AHKBot, and tailored outreach to accountants to deliver GuLoader and Remcos.
The activity shows attackers exploiting tax filing urgency and trust in government communications to compromise users and enterprise environments. Microsoft published indicators and mitigation guidance including MFA, phishing-resistant authentication, Safe Links, network protection, and Defender detections, while the IRS continues to direct the public to report fake IRS, Treasury, or other tax-related emails and messages through its phishing reporting channels.
Get the infrastructure and lures behind it.
7 events from the most recent confirmed update back to the earliest known activity.
On March 3, 2025, Microsoft observed a tax-themed phishing campaign targeting CPAs and accountants in the United States with fewer than 100 emails. The attack began with a benign rapport-building message and, after the victim replied, progressed to a malicious PDF chain that installed GuLoader and then Remcos.
On February 13, 2025, Microsoft observed an IRS-themed phishing campaign targeting U.S. users with the subject 'IRS Refund Eligibility Notification.' The campaign abused a Google business open redirect to deliver a malicious Excel file that, if macros were enabled, installed AHKBot components and a screenshot-capturing module.
On February 6, 2025, Microsoft observed a phishing campaign attributed to Storm-0249 that sent several thousand tax-themed emails targeting the United States. The emails used IRS filing, audit, and unusual activity lures and led victims through redirect chains to fake DocuSign pages that delivered BruteRatel C4 and then Latrodectus.
Between February 12 and 28, 2025, Microsoft observed tax-themed phishing emails sent to more than 2,300 organizations, mostly in the United States and especially in engineering, IT, and consulting. The emails used empty bodies and PDF-embedded QR codes that directed victims to a RaccoonO365-linked credential phishing domain.
Microsoft said Latrodectus version 1.9 was first observed in February 2025. The version reintroduced scheduled-task persistence and command execution via cmd.exe.
Microsoft reported that it observed several tax-themed phishing and malware campaigns in early 2025 targeting primarily U.S. organizations and individuals as Tax Day approached. The campaigns used IRS and tax-document lures, QR codes, malicious attachments, and legitimate-service abuse to steal credentials or deploy malware including BruteRatel C4, Latrodectus, RaccoonO365, AHKBot, GuLoader, and Remcos.
At the end of January 2024, Microsoft Threat Intelligence observed a tax-season phishing campaign using employer-themed tax document lures. The emails carried HTML attachments that led victims to fake landing pages and then malicious executables that installed information-stealing malware to collect credentials and other sensitive data.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 26 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
3 references tracked. Mallory keeps watching after this page renders.
microsoft.com
Open sourceblogs.technet.microsoft.com
Open sourceirs.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported multiple U.S.-focused phishing campaigns that used **tax-themed lures** to trick victims into opening password-protected ZIP archives and malicious Windows shortcut (`.lnk`) files. Microsoft said the activity targeted accounting, tax preparation, CPA, bookkeeping, and financial services firms, with emails posing as client tax documents and using AWS click-tracking links at `awstrack[.]me` to redirect users to hosted ZIP files. Securonix separately described a related campaign it tracks as **TACTICAL#OCTOPUS**, which used similar tax-season themes and staged lure PDFs to infect victims. The infection chains relied on `.lnk` files to launch PowerShell and VBScript, retrieve additional MSI, DLL, EXE, and PDF payloads, and in some cases use **GuLoader/CloudEyE** to execute shellcode and deliver **Remcos** or other malware directly in memory. Securonix said newer samples shifted from encoded IP-based URLs to public redirect services such as `rebrand.ly`, while payloads used process injection into Internet Explorer utilities including `ieinstal.exe` and `ielowutil.exe` to evade detection. Researchers said the resulting compromises enabled remote access, keystroke logging, clipboard capture, information theft, and potential lateral movement, with observed command-and-control infrastructure including `5.8.8.100`, `109.206.240.67`, and `194.180.48.211`.
Aug 15, 2026
Tax-season social engineering is driving a spike in **impersonation scams** that use urgent “official notice” language to push victims into clicking links, opening attachments, or calling fake support numbers. One campaign spoofing the **US Social Security Administration** uses emails with subject lines like “Important Disclosures” and attachments masquerading as PDFs (e.g., `Social_security_statements_2025.pdf`) that instead deploy **Datto RMM** to establish remote access and can lead to **RAT** installation and full device control for data theft. Separately, consumer-facing “**Apple Security Alert**” pop-ups/texts/emails claim a device is hacked or an **Apple Pay** transaction is under review and direct targets to call a listed phone number—an indicator of **tech-support/payment fraud** rather than a specific malware delivery chain. Broader reporting on tax scams cites survey data indicating an average victim loss of **$1,020**, increased perceived sophistication (including AI-enabled realism), and common lures across phone/email/text that pressure recipients to click links or send payments; this provides context on scale and victim impact but does not attribute to the specific SSA-themed malware campaign.
Jun 29, 2026
A sophisticated phishing campaign targeting Indian entities has been attributed to the SideWinder advanced persistent threat group. Attackers impersonate the Indian Income Tax Department by sending tax-themed emails that urge recipients to review an inspection document. These emails contain links to a fake tax portal closely mimicking the legitimate government site, which then delivers a malicious ZIP archive. The archive includes a renamed, signed Microsoft Defender binary and a malicious DLL, exploiting DLL side-loading to install a Windows backdoor. The malware performs geofencing by checking the victim's timezone and only proceeds if it matches South Asian regions, thereby targeting Indian organizations specifically. Once installed, the backdoor enables file theft, data capture, and remote control by the attackers, with connections observed to known SideWinder command-and-control servers. Security researchers have noted a surge in tax-themed phishing and malware campaigns during the Indian tax filing season, leveraging public discussions about refunds to increase credibility. The spear-phishing emails often originate from suspicious domains and use embedded images to bypass spam filters, further enhancing their effectiveness. The infection chain is multi-stage, ultimately deploying persistent remote access trojans or infostealers. These campaigns highlight the evolving tactics of threat actors in targeting Indian businesses and government-related entities through highly convincing social engineering and technical subterfuge.
Jun 29, 2026