TAX SEASON EMAIL ATTACKS: ADWIND RATS AND TYCOON 2FA PHISHING KITS

Summary from the TLDR InfoSec newsletter

Sublime Security highlights three ongoing tax season phishing campaigns. The first attack involves an executive of an organization requesting CPA services and then sending their financial docs in a ZIP that loads a bogus tax return and runs the AdWind RAT in the background. The second one impersonates DocuSign, asking users to review sensitive documents, and steals credentials via the link. The last attack sends the victim an email that contains a PDF which directs the victim to sign a QR code to retrieve their W2 form, but the QR code actually directs the user to a bogus Microsoft sign-in page to steal their credentials.