U.S. Tax Season: How Threat Actors Exploit IRS Phishing, W-2 Fraud, and Dark Web Activity

This report explains how cybercriminals exploit the U.S. tax season through IRS-themed phishing, W-2 fraud and BEC schemes, and the sale of stolen taxpayer data on Dark Web marketplaces; it highlights common TTPs (spear-phishing, credential harvesting, malware attachments), cites large-scale financial impact and an alleged 1.9M-record dataset for sale, and recommends defenses including verification procedures, email authentication, MFA, and Dark Web monitoring.