Tax season email attacks: AdWind RATs and Tycoon 2FA phishing kits · Blog · Sublime Security

Sublime Security details several tax-season email scams: a VIP-impersonation campaign that lures a CPA into opening a ZIP/LNK that launches a fake PDF while installing the AdWind RAT, DocuSign-themed credential phishing that redirects victims through Cloudflare to fake login pages, and QR-code-based phishing using the tycoon/storm1747 kit which abuses compromised corporate accounts; the post includes attack flows, detection signals (new domains, mismatched reply-to, SPF/DMARC observations, IP/timezone anomalies), and example IoCs used to detect and block these threats.