The Internal Revenue Service (IRS) has issued a warning to taxpayers and tax professionals about an active scam campaign that sends phishing emails to deliver malware.
This warning was issued after several reports were sent to the IRS by taxpayers this week regarding spam emails with the subject lines “Automatic Income Tax Reminder” or “Electronic Tax Return Reminder” originating from hackers impersonating the U.S. Internal Revenue Service using spoofed email addresses.
The emails have links that point to a website that looks like IRS.gov with notifications regarding the taxpayer's refund, electronic return, or tax bill.
The emails contain a temporary password or a passcode to access the files for filing a refund. But when taxpayers try to access them, it turns out to be a malicious file.
After entering the password sent in the spam email, victims download malicious programs that could allow hackers to either collect sensitive information or take control of compromised systems.
This new scam uses dozens of compromised websites and web addresses posing as IRS.gov. By infecting computers with malware, scammers can gain control of a taxpayer's computer or secretly download software that monitors every keystroke, ultimately giving them passwords to sensitive accounts, such as bank accounts.
Today's warning can help both taxpayers and tax professionals combat attacks aimed at concealing sensitive information, such as attacks targeting tax season using realistic phishing emails containing malicious attachments.
It is worth noting that attackers are also using telephone scams, as observed in 2016, to ask potential victims to clear outstanding debts of thousands of dollars through payments.
