Cofense Email Security

IRS Tax Refund Email Phishing Campaign: Claim Your Phish

By Harsh Patel, Cofense Phishing Defense Center

The U.S. tax season is underway and emails from the IRS are normal, even expected. In addition to that is stimulus check anxiety, users questioning whether they will receive it and waiting for any information that becomes available. Threat actors are adept at crafting their attacks using current events as has been noted with the pandemic and the numerous campaigns that grew from it. In this case, a well-conditioned user reported an email using Cofense Reporter, which sent it to the Cofense Phishing Defense Center (PDC) that was able to quickly alert via Cofense Triage. This email is a newer phishing campaign that steals tax-filing information by posing as an IRS email related to the much needed stimulus check.

Figure 1: Email Body

The subject and supposed sender of this phishing attack is immediately eye-catching: “Recalculation of Your Tax Refund Payment” followed by the sender name: “IRS”. Most users realize it’s unlikely this email would end up in their work email account rather than their personal email account.

The email body begins with “Dear Applicant.” With this type of wording, it’s easy for the threat actor to send this email to any number of people at any company. Adversely, the lack of specification to whom the email is addressed is a characteristic of potentially malicious emails users have been warned about. This may explain the line at the bottom of the email that states “This is an automatically generated email sent to” followed by the recipient’s email, perhaps to add a layer of specificity for authenticity.

Reading further, the email informs the user that, upon inspection of their last tax refund, they are now eligible for “an extra tax refund of 1400.00 USD”. Based on the amount and timing, it can be assumed that this was referencing the recent stimulus check.

Figure 2: Email Header

The attacker spoofed the from and return-path field to show that this email is coming from the address: [email protected], where is replaced with the user’s company name. However, upon closer inspection, the actual originating source is shown in the headers as “X – Authenticated-UID” coming from an external compromised user.