Phishing Alert - New Tax Season Schemes Uncovered

What Happened

As tax season approaches, a wave of phishing scams has emerged, targeting individuals and organizations alike. These schemes exploit the urgency of tax filing, with attackers impersonating the Internal Revenue Service (IRS) to lure victims. Reports indicate that over 29,000 individuals across 10,000 organizations have been affected by these phishing campaigns, primarily in the United States. The campaigns have ramped up as the April 15 deadline nears, with threat actors eager to exploit the situation.

Malicious emails claiming irregularities in tax return filings have been a common tactic. These emails often contain links or attachments that deploy malware or facilitate credential theft. In one notable case, attackers used a trojanized version of ConnectWise ScreenConnect, a remote monitoring tool, to exfiltrate data and harvest credentials from unsuspecting victims.

Who's Being Targeted

The phishing campaigns have predominantly targeted organizations in sectors such as manufacturing, healthcare, and retail. Almost 100 organizations have been specifically identified as victims of a campaign utilizing QR codes and W2 forms to redirect users to fake Microsoft 365 login pages. These tactics aim to compromise not only usernames and passwords but also two-factor authentication codes.

The attackers are leveraging the urgency of tax season to increase their success rates. With many individuals focused on filing their returns, the likelihood of falling for these scams is heightened. The Microsoft Threat Intelligence team has been actively monitoring these developments and sharing insights on the evolving tactics used by these cybercriminals.

Signs of Infection

Recognizing the signs of a phishing attack is crucial. Victims may notice unusual emails that contain:

• Claims of tax return irregularities
• Links to unfamiliar websites, particularly those mimicking official IRS or Microsoft pages
• Requests for sensitive information, including personal identification numbers and financial details

If you receive an email that seems suspicious, it’s essential to verify its authenticity before clicking any links or providing information. The increase in phishing attempts has been staggering, with a reported 277% rise in the exploitation of remote monitoring tools among threat actors.

How to Protect Yourself

To safeguard against these phishing schemes, consider the following steps:

• Verify the sender's email address before engaging with any emails related to tax filings.
• Do not click on links or download attachments from unknown sources.
• Use security software that can detect and block phishing attempts.
• Educate yourself and your colleagues about common phishing tactics and how to recognize them.

By staying informed and cautious, individuals and organizations can better protect themselves from these malicious schemes. The key is awareness and vigilance during this critical tax season.