{"id":353,"date":"2026-03-23T11:38:56","date_gmt":"2026-03-23T11:38:56","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=353"},"modified":"2026-03-23T11:38:56","modified_gmt":"2026-03-23T11:38:56","slug":"microsoft-warns-irs-phishing-hits-29000-users-deploys-rmm-malware","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=353","title":{"rendered":"Microsoft Warns IRS Phishing Hits 29,000 Users, Deploys RMM Malware"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Mar 23, 2026<\/span><\/span>Email Security \/ Cloud Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Microsoft has warned of fresh campaigns that are capitalizing on the upcoming tax season in the U.S. to harvest credentials and deliver malware.<\/p>\n

The email campaigns take advantage of the urgency and time-sensitive nature of emails to send phishing messages masquerading as refund notices, payroll forms, filing reminders, and requests from tax professionals to deceive recipients into opening malicious attachments, scanning QR code, or interacting with suspicious links.<\/p>\n

\u00abMany campaigns target individuals for personal and financial data theft, but others specifically target accountants and other professionals who handle sensitive documents, have access to financial data, and are accustomed to receiving tax-related emails during this period,\u00bb the Microsoft Threat Intelligence and Microsoft Defender Security Research teams said<\/a> in a report published last week.<\/p>\n

While some of these efforts direct users to sketchy pages designed through Phishing-as-a-service (PhaaS) platforms, others result in the deployment of legitimate remote monitoring and management tools (RMMs), such as ConnectWise ScreenConnect, Datto, and SimpleHelp, enabling the attackers to gain persistent access to compromised devices.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The details of some of the campaigns are below –<\/p>\n