Hackers are Using “Legit” IT Tools to Hijack the 2026 Tax Season

As 2026 tax season peaks, Proofpoint researchers report a significant rise in tax-themed cyber campaigns—over 100 distinct campaigns—leveraging Remote Monitoring and Management (RMM) tools, malware, credential phishing, and business email compromise. Actors such as TA4922 and TA2730 impersonate tax authorities or use financial forms (e.g., W-8BEN, W-2) to harvest credentials, escalate social engineering via out-of-band contact, and deliver information-stealing payloads; defenders are advised to train users, enforce allow-lists for RMMs, and remain vigilant to timely lure themes.