Microsoft Warns IRS Phishing Hits 29,000 Users, Deploys RMM Malware

"Microsoft uncovers phishing scam targeting 29,000 users with fake IRS emails during tax season to deploy malware."

Mar 23, 2026

ON THIS PAGE

Microsoft has identified a major phishing campaign that compromised 29,000 users during tax season using fake IRS emails. The attackers sent convincing tax-themed messages that appeared to come from legitimate tax authorities, tricking victims into revealing their login credentials.

Once successful, hackers deployed Remote Monitoring and Management (RMM) malware on compromised systems, giving them ongoing access to victims' computers. The timing exploits people's heightened attention to tax-related communications during filing season.

Microsoft is actively tracking this threat as part of its intelligence operations, highlighting how phishing remains an effective attack method for both stealing credentials and installing malware.

Source: The Hacker News

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?