U.S. tax-season phishing and malware-delivery campaign
Campaign
Summary
Hide ▲
Show ▼
The U.S. tax-season phishing campaigns are harvesting credentials and delivering malware, putting individuals, accountants, and other professionals at risk. The lures mimic refund notices, payroll forms, filing reminders, and tax-related requests to push victims into opening malicious files, scanning QR codes, or clicking suspicious links. One large wave on February 10, 2026 affected more than 29,000 users across 10,000 organizations. The activity also uses PhaaS kits and RMM tools such as ScreenConnect, Datto, and SimpleHelp to gain persistent access and steal data.
Related Happenings
TA4922 expanded European phishing-and-malware campaign
Campaign
H score40
First: 04.06.2026 00:45
Last: 04.06.2026 00:45
Sources 1
About this happening:
**TA4922** is a **China-linked** cybercrime campaign that has expanded from **East Asia** into **Europe and Africa**, including **the U.K., Germany, Italy, and South Africa**. The...
TA4922 expanded European phishing-and-malware campaign
CampaignAbout this happening: **TA4922** is a **China-linked** cybercrime campaign that has expanded from **East Asia** into **Europe and Africa**, including **the U.K., Germany, Italy, and South Africa**. The...
QR code phishing surged across email threats in Q1 2026
Trend
H score73
First: 05.05.2026 09:35
Last: 05.05.2026 09:35
Sources 1
About this happening:
**Q1 2026** email-threat telemetry shows **QR code phishing** and **CAPTCHA-gated phishing** rising quickly, increasing the risk of **credential theft** across **organizations**....
QR code phishing surged across email threats in Q1 2026
TrendAbout this happening: **Q1 2026** email-threat telemetry shows **QR code phishing** and **CAPTCHA-gated phishing** rising quickly, increasing the risk of **credential theft** across **organizations**....
Amazon SES phishing and BEC abuse campaign
Campaign
H score29
First: 04.05.2026 23:03
Last: 04.05.2026 23:03
Sources 1
About this happening:
A phishing campaign is abusing Amazon Simple Email Service (SES) to send convincing emails that can bypass standard authentication and reputation-based defenses. Attackers are usi...
Amazon SES phishing and BEC abuse campaign
CampaignAbout this happening: A phishing campaign is abusing Amazon Simple Email Service (SES) to send convincing emails that can bypass standard authentication and reputation-based defenses. Attackers are usi...
Formbook phishing campaign using DLL sideloading and obfuscated JavaScript
Campaign
H score30
First: 20.04.2026 18:01
Last: 20.04.2026 18:01
Sources 1
About this happening:
The **Formbook** phishing operation is targeting **Windows** organizations across **Greece, Spain, Slovenia, Bosnia, Croatia** and **South America**, using **DLL sideloading** and...
Formbook phishing campaign using DLL sideloading and obfuscated JavaScript
CampaignAbout this happening: The **Formbook** phishing operation is targeting **Windows** organizations across **Greece, Spain, Slovenia, Bosnia, Croatia** and **South America**, using **DLL sideloading** and...
Scattered Spider SMS phishing and SIM-swap crypto theft campaign
Campaign
H score53
First: 20.04.2026 16:33
Last: 20.04.2026 16:33
Sources 1
About this happening:
The **Scattered Spider** campaign used **SMS phishing** and **SIM swap** attacks to steal employee credentials, hijack phone numbers, and take over email and **virtual currency wa...
Scattered Spider SMS phishing and SIM-swap crypto theft campaign
CampaignAbout this happening: The **Scattered Spider** campaign used **SMS phishing** and **SIM swap** attacks to steal employee credentials, hijack phone numbers, and take over email and **virtual currency wa...
Timeline
-
23.03.2026 12:55 1 articles · 3mo ago
IRS impersonation phishing wave affects more than 29,000 users
Victim Impact UpdateOn February 10, 2026, an IRS-impersonation phishing wave affected more than 29,000 users across 10,000 organizations, mostly in the U.S.; recipients were told to review purportedly irregular tax returns by downloading an "IRS Transcript Viewer" and were redirected through a "Download IRS Transcript View 5.1" button to smartvault[.]im, where a malicious ScreenConnect package enabled remote access and credential harvesting.
Show sources
- Microsoft Warns IRS Phishing Hits 29,000 Users, Deploys RMM Malware — thehackernews.com — 23.03.2026 12:55
-
23.03.2026 12:55 2 articles · 3mo ago
Microsoft warns of tax-season phishing campaigns
Initial DisclosureMicrosoft warned that U.S. tax-season phishing campaigns were targeting individuals, accountants, and other professionals with refund notices, payroll forms, filing reminders, QR codes, suspicious links, and IRS-themed lures to steal credentials and deliver malware, with some operations using PhaaS pages and others deploying ScreenConnect, Datto, or SimpleHelp for persistent access.
Show sources
- Microsoft Warns IRS Phishing Hits 29,000 Users, Deploys RMM Malware — thehackernews.com — 23.03.2026 12:55
- Microsoft Warns IRS Phishing Hits 29,000 Users, Deploys RMM Malware — thehackernews.com — 23.03.2026 12:55