Tax Time: Let the Phishing Begin
Summary: Cisco Talos reported a tax-themed spear-phishing campaign beginning the Tuesday before the April 15 US tax deadline, with emails using subjects like "Payment Confirmation" and "Federal tax payment" and a Word attachment (receipt_4676373.doc) carrying a VBA script that auto-executed on open. By Wednesday the sender addresses had widened beyond gov-related domains, the attachment changed to receipt_3458934.doc, and the body added a refund line such as "Total: $1206.86"; the macro downloaded and launched Vawtrak, a banking Trojan built to capture credentials for over a hundred specific online sites.
What you should know: Talos notes this wave specifically targeted high-level security professionals and CTOs at technical companies, and Vawtrak harvests credentials across more than a hundred sites, so the people best positioned to spot phishing were themselves the intended entry point.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026