← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
When tax season becomes cyberattack season: Phishing and malware campaigns using tax-related lures
WHITE Tr1sa111 2026-03-21 Modified: 2026-03-21
9
IOCs
LOW VOLUME
dattophishingirs impersonationcpa targetingsimplehelpcredential theftscreenconnectremote monitoring toolstax seasonsocial engineeringmalware
MITRE ATT&CK & Malware Families
ATT&CK TECHNIQUES
MALWARE FAMILIES
ScreenConnect SimpleHelp Datto
Indicators of Compromise (9)
All FileHash-SHA256 domain
TYPEINDICATORDESCRIPTIONCREATED
FileHash-SHA256 45b6b4db1be6698c29ffde9daeb8ffaa344b687d3badded2f8c68c922cdce6e0 — 2026-03-21
FileHash-SHA256 d422f6f5310af1e72f6113a2a592916f58e3871c58d0e46f058d4b669a3a0fd8 — 2026-03-21
domain edud.site — 2026-03-21
domain gov-irs216.net — 2026-03-21
domain irs-doc.com — 2026-03-21
domain private-adobe-client.im — 2026-03-21
domain smartvault.im — 2026-03-21
domain tax-statments2025.com — 2026-03-21
domain taxationstatments2025.com — 2026-03-21
References (1)
↗ https://www.microsoft.com/en-us/security/blog/2026/03/19/when-tax-season-becomes-cyberattack-season-phishing-and-malware-campaigns-using-tax-related-lures/