Microsoft Warns of Tax-Season Phishing Using RMM Tools and PhaaS Kits
Summary
Microsoft warns that tax-season phishing uses PhaaS kits to steal credentials and legitimate RMM tools to gain access. A February 10 campaign affected over 29,000 users across 10,000 organizations, delivering ScreenConnect via smartvault[.]im.
Key points
- Tax-themed emails impersonate authorities and tax professionals, using refund, payroll, W2, and filing lures to steal credentials and 2FA codes.
- Microsoft described campaigns using the Energy365 and SneakyLog (Kratos) PhaaS kits to create phishing pages.
- Attackers deploy legitimate RMM tools including ScreenConnect, Datto, and SimpleHelp to gain persistent access and support data theft.
- A February 10, 2026 campaign affected more than 29,000 users across 10,000 organizations; about 95% of targets were in the U.S.
- The campaign's emails redirected recipients to smartvault[.]im, which Microsoft said delivered a maliciously packaged ScreenConnect.
- Microsoft recommends enforcing 2FA, applying conditional access, monitoring email and web activity, and blocking malicious domains; Huntress reported a 277% year-over-year rise in RMM abuse.
Article Details
- Event Type
- Microsoft-reported tax-season phishing campaigns using tax-themed lures, phishing-as-a-service kits, and legitimate remote monitoring and management software to steal credentials and gain remote access.
- Impact
- Microsoft reported a February 10, 2026 campaign affecting more than 29,000 users across 10,000 organizations; about 95% of targets were in the U.S. Other reported campaigns targeted individuals and tax professionals, captured credentials and 2FA codes, delivered remote-access software, and enabled data theft. Microsoft said the campaigns used ScreenConnect, Datto, or SimpleHelp, among other methods. A separate report attributed a 277% year-over-year increase in RMM abuse to Huntress.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | gov-irs216[.]net | Malicious domain impersonating the IRS and used to deliver ScreenConnect or SimpleHelp. |
| DOMAIN | irs-doc[.]com | Malicious domain impersonating the IRS and used to deliver ScreenConnect or SimpleHelp. |
| DOMAIN | smartvault[.]im | Phishing domain masquerading as SmartVault; the campaign used it to deliver a maliciously packaged ScreenConnect. |
| DOMAIN | telegrgam[.]com | Typosquatted Telegram download site used to distribute trojanized installers. |
MITRE ATT&CK
T1055.001 · Dynamic-link Library InjectionA reported XWorm infection chain used reflective DLL injection.T1059.001 · PowerShellA reported campaign used PowerShell to fetch and run a loader.T1219 · Remote Access ToolsAttackers deployed legitimate RMM software, including ScreenConnect, Datto, and SimpleHelp, for remote access.T1566.001 · Spearphishing AttachmentCampaigns used phishing emails with malicious attachments and tax-themed lures.T1566.002 · Spearphishing LinkCampaigns used phishing links, including links to credential-harvesting pages and malware delivery sites.
People
Malware
MeshAgenttools, stock-market trading utilities, game mods, VPNs, and emulators, to deliver Salat Stealer or MeshAgent, along with a cryptocurrency miner.NetSupport RATUsing phishing emails and ClickFix ploys to deliver NetSupport RAT and gain unauthorized system access, exfiltrate data, and deploy additional malware.Remcos RATSimilar requests for quotation lures have also been used to trigger a fileless Remcos RAT infection chain.Salat Stealervoice-changing tools, stock-market trading utilities, game mods, VPNs, and emulators, to deliver Salat Stealer or MeshAgent, along with a cryptocurrency miner.SILENTCONNECTpage that delivers a VBScript, which then runs PowerShell code to fetch an evasive .NET loader dubbed SILENTCONNECT from Google Drive to eventually deliver ScreenConnect.XWorm 7.1script, which launches the trusted Microsoft application “Aspnet_compiler.exe” and injects into it an XWorm 7.1 payload via reflective DLL injection.
Vendors
AmazonA February 10 campaign affected over 29,000 users across 10,000 organizations in the U.S., abusing Amazon SES and spoofed SmartVault domains to deliver ScreenConnect.CloudflareThe phishing site relied on Cloudflare to keep bots and automated scanners at bay, thus ensuring that only human users are served the main payload: a maliciously packaged ScreenConnect that grants the attackers remoteGoogleUsing fake Google Meet and Zoom pages to lure users into fraudulent video calls that ultimately deliver remote-access software like Teramind, a legitimate employee monitoring platform, by means of a bogus softwareMicrosoftMicrosoft warns of new taxâseason phishing campaigns that impersonate tax authorities and professionals to harvest credentials, deploy remoteâaccess software, and exfiltrate data.
Products
Amazon Simple Email ServiceThe emails, which were sent through Amazon Simple Email Service (SES), contained a “Download IRS Transcript View 5.1” button that, when clicked, redirected users to smartvault[.]im, a domain masquerading as SmartVault,Azure MonitorAbusing Microsoft Azure Monitor alert notifications to deliver callback phishing emails that use invoice and unauthorized-payment lures.DattoAttackers use PhishingâasâaâService kits and layered redirection to evade detection and abuse legitimate RMM tools like ScreenConnect, Datto, and SimpleHelp for persistent access.Google Drivea VBScript, which then runs PowerShell code to fetch an evasive .NET loader dubbed SILENTCONNECT from Google Drive to eventually deliver ScreenConnect.Microsoft 365 Apps for Enterpriseand healthcare industries located in the U.S., to direct users to phishing pages mimicking the Microsoft 365 sign-in pages and built using the SneakyLog (aka Kratos) PhaaS platform to siphon their credentialsScreenConnectAttackers use PhishingâasâaâService kits and layered redirection to evade detection and abuse legitimate RMM tools like ScreenConnect, Datto, and SimpleHelp for persistent access.SimpleHelpAttackers use PhishingâasâaâService kits and layered redirection to evade detection and abuse legitimate RMM tools like ScreenConnect, Datto, and SimpleHelp for persistent access.SmartVaultA February 10 campaign affected over 29,000 users across 10,000 organizations in the U.S., abusing Amazon SES and spoofed SmartVault domains to deliver ScreenConnect.TeramindZoom pages to lure users into fraudulent video calls that ultimately deliver remote-access software like Teramind, a legitimate employee monitoring platform, by means of a bogus software update.
Tools
Energy365PhaaS kits such as Energy365 and SneakyLog are used to create convincing phishing pages and distribute hundreds of thousands of malicious emails.Kratosusers to phishing pages mimicking the Microsoft 365 sign-in pages and built using the SneakyLog (aka Kratos) PhaaS platform to siphon their credentials and two-factor authentication (2FA) codes.SneakyLog#Energy365
Countries
AustraliaThe campaign has specifically targeted users in the U.S., the U.K., India, Brazil, France, Canada, and Australia.BrazilThe campaign has specifically targeted users in the U.S., the U.K., India, Brazil, France, Canada, and Australia.CanadaThe campaign has specifically targeted users in the U.S., the U.K., India, Brazil, France, Canada, and Australia.FranceThe campaign has specifically targeted users in the U.S., the U.K., India, Brazil, France, Canada, and Australia.IndiaThe campaign has specifically targeted users in the U.S., the U.K., India, Brazil, France, Canada, and Australia.United KingdomThe campaign has specifically targeted users in the U.S., the U.K., India, Brazil, France, Canada, and Australia.United StatesA February 10 campaign affected over 29,000 users across 10,000 organizations in the U.S., abusing Amazon SES and spoofed SmartVault domains to deliver ScreenConnect.
Industries
Financial ServicesAbout 95% of the targets were located in the U.S., spanning industries like financial services (19%), technology and software (18%), and retail and consumer goods (15%).Healthcarecode and W2 lures to target approximately 100 organizations, mainly in the manufacturing, retail, and healthcare industries located in the U.S., to direct users to phishing pages mimicking the Microsoft 365 sign-inHigher Educationthe Internal Revenue Service (IRS) with a cryptocurrency lure that specifically targeted the higher education sector in the U.S., instructing recipients to download a “Cryptocurrency Tax Form 1099” by accessingManufacturingUsing QR code and W2 lures to target approximately 100 organizations, mainly in the manufacturing, retail, and healthcare industries located in the U.S., to direct users to phishing pages mimicking the Microsoft 365RetailUsing QR code and W2 lures to target approximately 100 organizations, mainly in the manufacturing, retail, and healthcare industries located in the U.S., to direct users to phishing pages mimicking the Microsoft 365Retail and Consumer GoodsAbout 95% of the targets were located in the U.S., spanning industries like financial services (19%), technology and software (18%), and retail and consumer goods (15%).technology and softwareAbout 95% of the targets were located in the U.S., spanning industries like financial services (19%), technology and software (18%), and retail and consumer goods (15%).