Latest cybersecurity reporting from selected sources.

Tax-season phishing floods deliver RMM malware, credential theft, BEC and tax-form scams

The UK’s tax office has received 135,500 reports of suspected scams in the past 10 months including 4800 related to self assessment filings

China-based phishing groups blamed for non-stop scam SMS messages about a supposed wayward package or unpaid toll fee are promoting a new offering, just in time for the holiday shopping season: Phishing kits for mass-creating fake but convincing e-commerce websites that convert customer payment card data into mobile wallets from Apple and Google. Experts say these same phishing groups also are now using SMS lures that promise unclaimed tax refunds and mobile rewards points.

Britain's Tax Collector HMRC Lost $63 Million to Fraudsters Wielding Taxpayer DataPolice on Thursday arrested 13 individuals in Romania and one in England on suspicion of engaging in a massive tax fraud scheme against Britain. The arrests appear to be tied to a gang that used phishing attacks against British taxpayers to steal $63 million via fraudulent tax claims.

Also: A $40M Block Penalty, US SEC Guidance on Crypto LawsThis week, a KiloEx exploit, Block fined $40M, U.S. Securities and Exchange Commission guidance on crypto laws, Senate Democrats slammed NCET disbandment, $4.3M scam disrupted, guilty plea in $3.3M tax evasion and a South Korea ban on crypto apps.

Also, BianLian Ransomware Hackers Aren't Really Mailing YouThis week, the U.S. sanctioned the Nemesis admin, Poco RAT spotted in Latin America, Apple challenged a British order to weaken encryption and the FBI warned against scam letters purportedly from BianLian. Also, a Nigerian tax scammer extradited to the U.S., a new botnet and a Webex vulnerability.

Mexican users have been targeted with tax-themed phishing lures at least since November 2023 to distribute a previously undocumented Windows malware called TimbreStealer

$1.3 billion lost as identity fraud – and greed – saw 57,000 or more seek unearned tax refunds One hundred and fifty people who worked for the Australian Taxation Office (ATO) have been investigated – and some prosecuted – for participating in a tax refund scam promoted on Facebook and TikTok.…

Claimants bombarded by phishing emails, phone calls and texts

Tactical#Octopus: Don't let users click on that zip file The last few days of America's tax season are stressful enough, dealing with deadlines and, increasingly, online scams. Now comes another one, a sophisticated and ongoing phishing campaign by a threat group dubbed "Tactical#Octopus" that is using tax-related lures to spread malware.…

Security pros need to look beyond user education to find and disarm fraudulent actors.

We're not talking princes here Four men suspected of committing wire fraud and identity theft have been arrested and now face extradition to America. It is alleged they conspired to break into US companies' servers, steal people's personally identifiable information (PII), use that info to file fraudulent tax returns, and collect their victims' tax refunds.…

Fraudsters are out in full force as Tax Day approaches. Use this list to keep your company’s employees informed on what to watch out for this year.