Elon Musk, the IRS, and Your Bank Account: Anatomy of a Multi-Stage Financial Scam

This report analyzes an active IRS- and Elon Musk-themed phishing campaign that lures victims to a credential-phishing page and a fraudulent "ElonMusk Dogecoin Initiative" cryptocurrency marketplace. The multi-stage scam harvests full names, contact details, photo IDs, employer information, and bank account/routing numbers (exfiltrated via a Telegram bot), using fake voucher redemptions, a staged trading dashboard, and support chat to build trust and extract additional PII—enabling identity theft, account takeover, and potential direct financial theft.