Cybercriminals Exploit URL Shorteners and QR Codes for Tax-Related Phishing Scams

Microsoft observed large-scale tax-themed phishing campaigns using RaccoonO365 PhaaS and evasive delivery techniques (QR codes, URL shorteners, legitimate hosting) to steal credentials and deliver loaders and remote-access malware (Latrodectus, BruteRatel C4, GuLoader, Remcos). The campaigns targeted thousands of users and organizations, including accountants and CPAs, and employed social engineering plus anti-analysis malware features to increase success and persistence; defenders are advised to apply MFA, phishing-resistant auth, endpoint detection, and user education.