Threat Research

Labs have uncovered targeted phishing campaigns in Taiwan that exploit local business workflows. The attacks deliver Winos 4.0 (ValleyRat) and additional malicious plugins through weaponized attachments and embedded links. Lures impersonate official communications, including tax audit notices, tax software installers, and cloud e-invoice downloads....

We identified phishing emails impersonating financial institutions, framed as alerts about expired W-8BEN tax forms. The attackers rapidly rotate domains to evade detection. Phishing pages use cloaking techniques and remain active only briefly....

We’ve identified an SMS phishing (smishing) campaign posing as the California Franchise Tax Board. The fraudulent websites use domain names that combine terms like “FTB,” “CA,” and “gov” to deceive users. These sites falsely promise tax refunds, but their true purpose is to harvest sensitive personal information, including Social Security numbers, addresses, and payment details...

Our researchers have observed a rise in campaigns and malicious domains impersonating tax agencies and financial organizations. This trend aligns with the annual surge in tax-related threats typically seen from December to April, coinciding with tax deadlines in the U.K. and U.S....