Cybercriminals Exploit Tax Season With New Phishing Tactics

Proofpoint reported more than a hundred tax-themed campaigns in early 2026 that use phishing, business email compromise and RMM-enabled remote access to deliver malware, harvest credentials and exfiltrate tax/financial forms; activity includes operations by emerging actors such as TA2730 targeting organizations in Asia and broader social-engineering lures tied to tax season.