IRS-Themed Phishing Campaign Uses TryCloudflare Links to Deliver RemotePC
Summary
CIS reports a phishing campaign targeting U.S. SLTT government entities with IRS- and SSA-themed TryCloudflare links that automatically download legitimate RemotePC software, potentially giving attackers access to victims’ computers.
Key points
- The campaign uses tax-themed lures impersonating the IRS or Social Security Administration to target U.S. state, local, tribal, and territorial government entities.
- In an observed case, visiting a TryCloudflare URL automatically downloaded a RemotePC installer; the page then redirected the user to the official IRS website.
- CIS identified seven TryCloudflare URLs that downloaded installers for legitimate RemotePC software.
- CIS assesses that attackers may seek unauthorized access for financially motivated follow-on activity, including credential theft, malware delivery, or selling access.
- CIS recommends raising organizational awareness of these phishing lures; MS-ISAC members received campaign reporting and IOCs.
Article Details
- Attack Vectors
- Tax-themed phishing lures impersonating the IRS or Social Security Administration targeted U.S. state, local, Tribal, and territorial government entities.
- A reported phishing link hosted on TryCloudflare automatically triggered a download of legitimate RemotePC software; the page redirected to the official irs.gov site after the download.
- The article reports that threat actors use legitimate remote monitoring and management software to obtain unauthorized access. It also describes Scattered Spider using phishing lures to deliver legitimate RMM tools in a separate, related campaign.
- Defensive Notes
- CIS CTI recommends raising organizational awareness of these lures.
- SLTT administrators should encourage users to be vigilant about urgent messages tied to timely events such as tax season.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| URL | hxxps[:]//invision-handle-sessions-travelling[.]trycloudflare[.]com/dashboard/hs/IRS_pnXkel6pr1CAn44.exe | Phishing URL that automatically triggered a RemotePC download. |
MITRE ATT&CK
T1219 · Remote Access ToolsThe campaign's installers downloaded legitimate RemotePC software, which the article says could give threat actors remote access to victims' computers.T1566.002 · Spearphishing LinkThe campaign used phishing links with tax-themed lures impersonating the IRS or Social Security Administration.