When tax season becomes cyberattack season: Phishing and malware campaigns using tax-related lures

During tax season, threat actors exploit the urgency of time-sensitive tax-related emails to trick targets into opening malicious attachments, scanning QR codes, or following link chains. Recent campaigns identified by Microsoft Threat Intelligence use lures around W-2 forms, tax forms, and impersonation of government tax agencies and financial institutions. These campaigns aim to harvest credentials or deliver malware, often using phishing-as-a-service platforms for convincing credential theft and MFA bypass. Notable tactics include using legitimate remote monitoring tools, targeting specific industries and roles like accountants, and employing sophisticated social engineering techniques. The campaigns leverage various file formats, legitimate infrastructure, and multiple user interactions to complicate detection.

• Managed for Malice: How Attackers Turn MDM into Remote AccessCampaign2026-10-28
• How to download and read ebooks safely | Kaspersky official blogAnalysis2026-10-30
• Tricks from the Past deployed via signed ChatGPT and Claude binariesMalware2026-10-27
• TIKTOUK: Tracing a WordPress Credential Collection ToolkitMalware2026-10-01
• Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealerMalware2026-10-31