ZeroFox Intelligence Flash Report - Financial Scams Threaten U.S. Tax Returns

ZeroFox Intelligence Flash Report - Financial Scams Threaten U.S. Tax Returns

Product Serial: F-2025-03-21a

TLP:CLEAR

In this Flash Report, ZeroFox researchers report on a recently observed increase in malicious services offered within deep and dark web forums that enable the targeting of U.S. tax return processes.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here

Key Findings

• As the April 15 deadline of the 2024-2025 U.S. tax season nears, ZeroFox Intelligence has identified a notable increase in financial fraud-related activity seeking to exploit the spike in use of government services such as the Internal Revenue Service (IRS) and private financial services.
• Historically, the end of the U.S. tax season has been perceived as a lucrative targeting opportunity by financially motivated threat actors seeking to obtain compromised account credentials, personally identifiable information (PII), or personal financial information (PFI) to exploit tax return processes.
• Threat actors engaging in this activity deploy targeted social engineering schemes, malicious domains mimicking popular financial service platforms, and bespoke services available in deep and dark web (DDW) forums.
• Malicious activity targeting U.S. tax return processes and the associated PII and PFI is very likely to continue over the coming weeks. If users engaging with the IRS experience delays, there is a likely chance that they will continue to be targeted in the weeks following the April 15, 2025, tax filing deadline.