Security

Microsoft Tax-Season Phishing Attacks Target Credentials

3 min read

Summary

Microsoft is warning that tax-season phishing attacks are rising, with threat actors using fake CPA messages, W-2 QR codes, and 1099-themed lures to steal Microsoft 365 credentials and deliver malware or remote access tools. The campaigns matter because they are increasingly targeted and evasive, abusing trusted cloud services, multi-step redirects, and legitimate-looking tools to bypass defenses and raise the risk of account compromise and broader network intrusion.

Need help with Security?Talk to an Expert

Introduction

Tax season is once again proving to be prime time for cybercriminals. Microsoft reports a clear increase in phishing and malware campaigns that exploit the urgency of tax filings, refund notices, payroll forms, and accountant communications to trick users into surrendering credentials or launching malware.

For IT and security teams, this matters because these campaigns are not just generic spam. Many are highly targeted, personalized, and built to evade traditional detections through QR codes, multi-step link chains, cloud-hosted files, and the abuse of legitimate remote monitoring and management (RMM) tools.

What’s new

Microsoft highlighted several tax-themed attack patterns observed in early 2026:

  • CPA-themed phishing with Energy365
    Emails with subjects like "See Tax file" used Excel attachments that linked to OneNote files hosted on OneDrive, eventually redirecting users to credential-harvesting pages powered by the Energy365 phishing-as-a-service kit.

  • W-2 QR code phishing with SneakyLog
    Messages titled "2025 Employee Tax Docs" included Word documents containing personalized QR codes. Scanning the code led users to fake Microsoft 365 sign-in pages run through the SneakyLog/Kratos phishing kit, designed to steal credentials and 2FA information.

  • 1099 lures delivering ScreenConnect
    Tax-form themed domains impersonated financial and tax brands, leading users to download 1099-FR2025.exe, which installed ScreenConnect. Although legitimate, ScreenConnect can be abused by attackers as a remote access tool.

  • IRS and crypto-themed phishing
    Another campaign used fake IRS messaging and cryptocurrency-related social engineering, including copy-and-paste URLs instead of clickable links to reduce automated detection.

Why this matters for administrators

These campaigns show how attackers are blending:

  • convincing seasonal business context
  • phishing-as-a-service platforms that scale quickly
  • personalized attachments and landing pages
  • MFA bypass techniques
  • legitimate signed RMM tools for persistence and hands-on-keyboard access

Organizations in financial services, healthcare, education, manufacturing, retail, and IT were all observed as targets, with accountants and finance-adjacent roles particularly at risk.

IT administrators should take the following actions immediately:

  • Reinforce user awareness around tax-themed emails, especially unexpected W-2, 1099, CPA, and IRS messages.
  • Block or closely inspect QR code-based phishing and multi-stage attachment chains involving Excel, OneNote, and cloud storage links.
  • Review email security policies for impersonation protection, attachment scanning, and URL detonation.
  • Hunt for abuse of RMM tools such as ScreenConnect and SimpleHelp, especially when installed outside approved channels.
  • Strengthen identity protections with phishing-resistant MFA where possible and monitor for suspicious Microsoft 365 sign-in activity.
  • Use Microsoft Defender detection and hunting guidance from the advisory to identify related indicators of compromise.

Bottom line

Tax season gives attackers a predictable window to exploit urgency and trust. Microsoft’s latest findings are a reminder that organizations should treat tax-related messages as a high-risk phishing category and validate both identity activity and remote access tooling across the environment.

Need help with Security?

Our experts can help you implement and optimize your Microsoft solutions.

Talk to an Expert

Stay updated on Microsoft technologies

Read the original article by Microsoft Threat Intelligence and Microsoft Defender Security Research Team
SecurityphishingMicrosoft Defendertax seasonmalware

Related Posts

Security

macOS ClickFix Campaign Hides Behind Fingerprinting

Microsoft Threat Intelligence reports that a macOS ClickFix campaign has shifted from openly serving malicious lures to using server-side browser fingerprinting that mainly exposes the payload to likely macOS victims. The change makes the operation harder for crawlers, sandboxes, and defenders to spot, increasing the importance of hunting for shared infrastructure patterns and strengthening endpoint protections.

Security

Microsoft CNAPP Leader: KuppingerCole 2026 Report

Microsoft has been named a Leader across all four categories in KuppingerCole’s 2026 CNAPP Leadership Compass, highlighting Defender for Cloud’s unified approach to cloud and AI security. The recognition matters for security teams as CNAPP platforms increasingly focus on exploitability, attack path analysis, AI security posture, and integrated SOC operations across multicloud environments.

Security

ChainDrop npm Attack: Self-Propagating Worm Explained

Microsoft has detailed ChainDrop, a large-scale npm supply chain attack that compromised more than 400 packages using a self-propagating credential-stealing worm. The campaign matters because it targets developer workstations and CI/CD pipelines, steals cloud and publishing credentials, and can automatically republish infected packages across additional publishers.

Security

Microsoft Defender Device Isolation Stops Ransomware

Microsoft Defender’s attack disruption now includes automatic device isolation for compromised endpoints, adding a new containment layer beyond user-based response. In a published QNET case study, Defender isolated an endpoint in 128 seconds, stopping a multi-stage ransomware-related attack before persistence, credential theft, or lateral movement could occur.

Security

Zero Trust for AI: New Microsoft Security Tools

Microsoft has expanded its Zero Trust for AI strategy with new assessment capabilities, a DevSecOps pillar in the Zero Trust Workshop, and practical implementation guidance. The updates help security and platform teams assess AI-related risk, secure AI-assisted development, and build a phased roadmap for adopting Zero Trust controls across AI systems.

Security

CaptiveCrunch Malware Campaign Targets Travelers

Microsoft has disclosed CaptiveCrunch, an active campaign linked to Midnight Blizzard that hijacks traffic on hospitality and captive portal networks to steal credentials and deliver malware. The threat is especially relevant for organizations with frequent travelers because attackers are abusing Entra ID device code flows, fake update prompts, and adversary-in-the-middle phishing to compromise corporate accounts and endpoints.