DarkOwl Warns of Tax-Season Fraud Using Stolen Credentials, Phishing and Tax Forms

Summary

DarkOwl analysts report tax-related fraud activity across dark-web markets and Telegram, including phishing panels, stolen credentials, and tax documents for sale. They advise avoiding password reuse and watching for phishing and malvertising.

Key points

DarkOwl analysts observed advertisements for tax-refund fraud guides, including an unverified claim that a method could bypass ID.ME facial verification.
The analysts found phishing panels impersonating services including ID.ME, PayPal, and USPS, as well as stealer logs that may expose account credentials and session cookies.
Tax forms and identity documents, including W2s and 1040s, were advertised for sale alongside other personal and financial information; the article says it is unclear whether some documents were stolen or fraudulent.
DarkOwl reported nearly 100,000 Telegram search hits for “tax refund” in its collection, and described sellers moving between dark-web marketplaces and private Telegram messaging.
The article says stealer logs containing credentials for tax-filing providers could enable account access and fraudulent filings; Telegram channels also advertised tax refunds through TurboTax.
The ransomware group PLAY and others reportedly claim to hold tax-related information about victims; if released, it could be used for further fraud. These are group claims, not confirmation of the data’s authenticity.
DarkOwl recommends avoiding password reuse and staying alert to phishing and malvertising.

Article Details

Event Type: Cybercriminal tax fraud activity, including the sale of tax-refund fraud guides, phishing panels, tax documents, and access to stolen credentials; ransomware groups also claim to hold tax-related data.
Impact: The reported activity could enable identity theft, fraudulent tax filings and refunds, and other financial fraud. Stolen credentials may expose tax-provider accounts, while tax-related data held by ransomware groups could be used for further fraud if released. The article does not confirm that the advertised tax documents are fraudulent or stolen, or that the claimed tax data has been released.

Threat Actors

PlayA ransomware group that the article says posts victim details and claims to hold information related to taxes.

Vendors

ID.MEis soliciting users to contact an individual to buy a tax refund methodology that allegedly bypasses the ID.ME facial recognition verification method that has recently been implemented by the IRS as a fraud prevention

Products

TelegramThe below advertisement from Telegram is soliciting users to contact an individual to buy a tax refund methodology that allegedly bypasses the ID.ME facial recognition verification method that has recently been TurboTaxThere are also Telegram channels which offer buyers the chance to obtain tax refunds through TurboTax.