The NJCCIC observed a phishing campaign that begins with an urgent-sounding message: "Final Notice: Your Tax Document(s) Is Now Available." The sender is identified as the "Internal Revenue Service," creating an immediate impression of authority and urgency. However, closer inspection reveals a classic cyberattack designed to compromise your device.
Although the display name purports to represent the IRS, the email address indicates otherwise: fujita_k[@]ostape[.]co[.]jp. The Internal Revenue Service communicates through official .gov domains (such as @irs.gov). An email originating from an unfamiliar foreign domain is a strong indication of spoofing.
A few different subject lines have been used, including "Reminder: Your Tax Document(s) Is Now Available" and “Email: Reminder: Your Tax Document(s) Is Now Available,” to bypass spam filters and prompt recipients to act quickly before carefully inspecting the email.
The links in these emails point to domains associated with ConnectWise ScreenConnect, a legitimate remote monitoring and management (RMM) tool for controlling desktop systems. However, when deployed by cybercriminals, it becomes a remote access trojan (RAT). If a user clicks the link and downloads the file, attackers gain full remote access to the victim's device, allowing them to steal sensitive personal information, capture keystrokes, install malware, or move deeper into internal networks.
Recommendations
- Exercise caution with communications from known senders or legitimate platforms.
- Confirm requests from senders via contact information obtained from verified and official sources before taking action, such as clicking on links or opening attachments.
- Navigate directly to legitimate websites and verify before submitting account credentials, providing personal or financial information, or downloading files.
- Enable multi-factor authentication (MFA) and keep systems and browsers up to date.
- If sensitive information was entered, change passwords for compromised accounts, monitor for unauthorized activity, and review the Identity Theft and Compromised PII NJCCIC Informational Report for additional recommendations and resources, including credit freezes.