By Harsh Patel, Cofense Phishing Defense Center

The U.S. tax season is underway and emails from the IRS are normal, even expected. In addition to that is stimulus check anxiety, users questioning whether they will receive it and waiting for any information that becomes available. Threat actors are adept at crafting their attacks using current events as has been noted with the pandemic and the numerous campaigns that grew from it. In this case, a well-conditioned user reported an email using Cofense Reporter, which sent it to the Cofense Phishing Defense Center (PDC) that was able to quickly alert via Cofense Triage. This email is a newer phishing campaign that steals tax-filing information by posing as an IRS email related to the much needed stimulus check.

Figure 1: Email Body

The subject and supposed sender of this phishing attack is immediately eye-catching: “Recalculation of Your Tax Refund Payment” followed by the sender name: “IRS”. Most users realize it’s unlikely this email would end up in their work email account rather than their personal email account.

The email body begins with “Dear Applicant.” With this type of wording, it’s easy for the threat actor to send this email to any number of people at any company. Adversely, the lack of specification to whom the email is addressed is a characteristic of potentially malicious emails users have been warned about. This may explain the line at the bottom of the email that states “This is an automatically generated email sent to” followed by the recipient’s email, perhaps to add a layer of specificity for authenticity.

Reading further, the email informs the user that, upon inspection of their last tax refund, they are now eligible for “an extra tax refund of 1400.00 USD”. Based on the amount and timing, it can be assumed that this was referencing the recent stimulus check.

Figure 2: Email Header

The attacker spoofed the from and return-path field to show that this email is coming from the address: [email protected], where is replaced with the user’s company name. However, upon closer inspection, the actual originating source is shown in the headers as “X – Authenticated-UID” coming from an external compromised user.

Figure 3-4: Phishing Page

Upon first visiting the page, the website prompts the user with the notification “AUTHORIZED USE ONLY” to appear authentic. Anyone visiting the legitimate website is familiar with this popup warning, which the threat actor took the additional step of replicating. However, a well-conditioned user would realize the legitimate IRS site doesn’t change the URL. Notably, this attack was hosted on the domain amplifyapp[.]com domain. This domain is associated with the AWS Amplify service which, according to the website, is the “Fastest, easiest way to build mobile and web apps that scale.” With this service, the threat actor has crafted this near identical IRS information page to harvest user tax information: social security number, name, birth date, filing pin and so on. Upon submitting all the required fields, the user is then redirected to the official IRS homepage as seen in Figure 5. This is the final page.