Microsoft has issued a warning regarding a new wave of phishing campaigns targeting taxpayers in the United States. The tech giant reports that these campaigns have already impacted approximately 29,000 users by impersonating official tax-related communications to steal credentials and install malware.

The malicious emails exploit the urgency of the current U.S. tax season. They are designed to appear as legitimate messages concerning tax refunds, payroll forms, filing reminders, or requests from tax professionals. This deception is intended to prompt recipients to open malicious attachments or click on embedded links.

Technical Details of the Attack

According to Microsoft’s security researchers, the campaign’s primary objective is credential theft. Once a user interacts with the phishing email, they are redirected to a fraudulent website that mimics a legitimate login portal, such as a corporate or financial services login page. Any credentials entered on this fake site are harvested by the attackers.

In more advanced attacks, the campaign deploys remote monitoring and management (RMM) software as a payload. While RMM tools are legitimate software used for IT support, threat actors abuse them to gain persistent, remote access to compromised systems. This access can be used for data theft, surveillance, or as a foothold for further attacks within a network.

Scope and Impact

The scale of the campaign, affecting tens of thousands of users, highlights a significant and coordinated threat. By leveraging the widespread public focus on tax deadlines, attackers increase the likelihood of their lures being successful. The use of RMM malware is particularly concerning for security professionals, as it can be difficult to detect and often bypasses traditional antivirus solutions.

Microsoft has not specified the exact time frame of the attacks but links them directly to the ongoing tax filing period. The company has taken steps to detect and block the associated malicious domains and payloads within its own ecosystem, including through its Defender security platform.

Official Recommendations for Protection

Microsoft and other cybersecurity authorities advise both individuals and organizations to exercise heightened caution during tax season. Users should verify the sender’s email address carefully, avoid clicking links or opening attachments in unsolicited emails, and navigate directly to official websites by typing the URL themselves.

For businesses, enforcing multi-factor authentication (MFA) is a critical defense, as it can prevent stolen credentials from being used. IT departments are also advised to monitor for unauthorized installations of remote access software and to implement application allowlisting where possible.

The expected continuation of tax-themed phishing attempts is likely through the April filing deadline and beyond. Security analysts predict that similar campaigns may emerge targeting other regions with different tax calendars. Microsoft and other security firms are expected to release further indicators of compromise and technical analysis as their investigations proceed.

Source: Microsoft Security Intelligence