Tax Season Cyberattacks - Phishing and Malware Campaigns Rise

What Happened

During tax season, cybercriminals ramp up their efforts, exploiting the urgency of tax-related communications. Microsoft Threat Intelligence has identified a surge in phishing and malware campaigns themed around tax forms, such as W-2s. These campaigns often impersonate legitimate government agencies and financial institutions, aiming to trick individuals and professionals into revealing sensitive information.

The campaigns are designed to harvest credentials or deliver malware. Phishing-as-a-service (PhaaS) platforms are increasingly being used, allowing attackers to craft highly convincing emails. These emails often contain malicious attachments or links that lead to phishing pages designed to steal personal and financial data.

Who's Being Targeted

The primary targets of these campaigns include individual taxpayers and professionals such as accountants who regularly handle sensitive documents. Attackers leverage the familiarity of tax-related emails to increase the likelihood of success. For instance, emails may appear to come from trusted sources, making it easier to deceive recipients into clicking on malicious links or opening infected attachments.

In recent months, campaigns have specifically targeted accountants with customized lures. These attacks are particularly dangerous as accountants are accustomed to receiving tax-related emails, making them more susceptible to phishing attempts.

Signs of Infection

Individuals and organizations should be aware of several signs that may indicate a phishing attempt or malware infection. Common indicators include:

• Unexpected emails with tax-related subject lines, especially those requesting personal information.
• Emails containing attachments like W-2 forms or links to unknown websites.
• Requests to copy and paste URLs instead of clicking links, which is a common tactic to evade detection.

If you notice any of these signs, it's crucial to act quickly to mitigate potential damage.

How to Protect Yourself

To defend against these seasonal phishing attacks, individuals and organizations should take proactive steps. Here are some recommended actions:

• Educate Users: Awareness training can help users recognize phishing attempts and understand the importance of verifying the source of emails.
• Email Security Settings: Configure essential email security settings to filter out suspicious messages.
• Multi-Factor Authentication: Implement MFA wherever possible to add an extra layer of security against credential theft.
• Regular Updates: Ensure that all software, including security tools, is kept up to date to protect against known vulnerabilities.

By staying informed and vigilant, individuals can better protect themselves during this peak season for cyberattacks.