Microsoft Warns IRS Phishing Hits 29,000 Users, Deploys RMM Malware

Microsoft has warned of multiple tax-season phishing campaigns targeting over 29,000 users across 10,000 organizations, deploying RMM malware for persistent access.

• •Campaigns use IRS impersonation, QR codes, W2 lures, and CPA-themed emails to deliver phishing pages via PhaaS platforms like Energy365 and SneakyLog (Kratos)
• •Attackers deploy legitimate RMM tools (ConnectWise ScreenConnect, Datto, SimpleHelp) to gain persistent remote access to compromised systems
• •A large-scale February 2026 campaign sent via Amazon SES targeted 95% U.S. users, with financial services (19%) and tech (18%) most affected
• •Phishing sites used Cloudflare to block bots and deliver maliciously packaged ScreenConnect installers
• •RMM tool abuse by threat actors surged 277% year-over-year, per Huntress research