All US taxpayers now need to check Gmail or Outlook – look for keywords your bank might leave blank

A seemingly harmless phrase in your inbox may indicate that you are a target of cyber criminals.

Security experts warn US taxpayers of a new phishing campaign.

1

With tax season approaching, scammers claim to be the IRS to install “Trojan Emotet” first spotted by Malwarebytes.

Trojan Emotet is malicious software that can steal data such as B. user credentials stored in the browser by listening to network traffic.

WHAT DOES THE EMAIL CONTAIN?

The phishing email uses the subject line “IRS Tax Forms W-9” and a spoofed return address from “IRS Online Center”.

So if you see the phrase “IRS” in an email, proceed with caution.

Remember that the IRS will never Contact you via email or text according to its website.

The full email is as follows:

“Let me know if you’d like a hard copy in the mail too.

Respectful [SIC]

Barbara LaCosta

inspector

treasury.”

But the telltale sign to look out for is the “Respectful” typo.

In addition, the email contains a 709 KB “W-9 form.zip” attachment containing a 548 MB Word document titled “W-9 form.doc”.

“You won’t find many real Word documents that weigh 500MB or more. In fact, a file size of 500MB is a potential indicator that Emotet is lurking in the background,” said Chris Boyd, Malwarebytes Malware Intelligence Analyst.

“Malware authors artificially increase the size of the document to try to fool or break security tools. This is because the large file size can prove too difficult for the tools to get to grips with and analyze properly,” he continues.

HOW TO AVOID A PHISHING SCAM

First, you should thoroughly check who sent the email.

Even if it looks official, double-check the email and look for any misspellings or slight anomalies in the sender’s email address.

Never feel pressured to open an attachment and avoid clicking on the phrase “activate content”.

You should also be careful with links in e-mails.

If you are sure an email you have received is a scam, report it to your email provider and delete it.