By Tonia Dudley, Cofense Security Solutions
What’s the first form you need to file in order to collect US taxes? Why a W-9 of course! So, what have we been seeing from Emotet as it gears up for filing taxes on your behalf? A W-9 phish of course!
As with any other trend we’ve seen from this threat actor, the email messages are not sophisticated – in fact, these are quite basic. We are seeing both an attachment (figure 1) and a simple link (figure 2) to download this document. And look, the attachment (figure 3) isn’t anything fancy either. While this tax season is just getting started, with many tax filing forms due to taxpayers last week, by Jan 31st, we anticipate these campaigns will likely evolve and get better as we move towards the annual filing date of April 15th.
Figure 1 – Emotet using W9 attachment
Figure 2 – Emotet with URL link to attachment
Figure 3 – Emotet W9 Attachment
FYI, this week has been declared Tax Identity Theft Awareness Week by the Federal Trade Commission (FTC). It’s a great time of the year to remind your organization, friends, and family to be vigilant in protecting their tax forms. Below are some tips from the FTC to better protect your identity during this tax season:
- Protect your SSN throughout the year. Don’t give it out unless there’s a good reason and you’re sure who you’re giving it to.
- File your tax return as early in the tax season as you can.
- Use a secure internet connection if you file electronically, or mail your tax return directly from the post office.
- Research a tax preparer thoroughly before you hand over personal information.
- Check your credit report at least once a year for free at annualcreditreport.com. Make sure no one has opened a new account in your name.
HOW COFENSE CAN HELP
Every day, the Cofense Phishing Defense Center analyzes phishing emails with malware payloads that bypassed email gateways. 100% of the threats found by the Cofense PDC were identified by the end user. 0% were stopped by technology.
Condition users to be resilient to evolving phishing attacks with Cofense PhishMe and remove the blind spot with Cofense Reporter.
Quickly turn user reported emails into actionable intelligence with Cofense Triage. Reduce exposure time by rapidly quarantining threats with Cofense Vision.
Easily consume phishing-specific threat intelligence to proactively defend your organization against evolving threats with Cofense Intelligence.
Thanks to our unique perspective, no one knows more about REAL phishing threats than Cofense. To understand them better, read the 2019 Phishing Threat & Malware Review.
The Cofense® and PhishMe® names and logos, as well as any other Cofense product or service names or logos displayed on this blog are registered trademarks or trademarks of Cofense Inc. All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks. Any observations contained in this blog regarding circumvention of end point protections are based on observations at a point in time based on a specific set of system configurations. Subsequent updates or different configurations may be effective at stopping these or similar threats.
