The IRS Impostor Blast That Hit 29,000 Inboxes Installed Signed ScreenConnect, and the Kits Did Not Retire After Tax Day

The malware that arrived disguised as an IRS transcript viewer did not need a custom virus. It needed a remote-access program that help desks already trust, a signature from the company that sells it, and an inbox belonging to someone whose job is to open tax attachments. That combination outlived April 15.

On March 19, 2026, Microsoft Threat Intelligence and Microsoft Defender Security Research published the anatomy of a season security teams had already been watching. Tax-themed mail posed as refund notices, payroll forms, and alerts about Electronic Filing Identification Numbers. Some messages only wanted a password. Others installed legitimate remote monitoring and management software. The largest blast, on February 10, reached more than 29,000 users at over 10,000 organizations. About 95 percent of the targets were in the United States. Two waves ran between 10:35 and 19:51 UTC. Banks, technology firms, and retailers absorbed big shares of the volume, but the intended readers clustered around accountants and tax preparers. The write-up is on the Microsoft Security Blog.

The AEGIS Alliance is less interested in the seasonal costume than in the tool underneath it. A signed ScreenConnect binary looks, to a tired firewall, like a technician doing a job. That is why the same kits were still useful in July, August, and September, long after the last extension form left a desk.

The Transcript Viewer Was ConnectWise in a Costume

The February messages claimed irregular returns had been filed under the recipient’s EFIN and offered a button labeled “Download IRS Transcript View 5.1.” Amazon SES sent the mail. The button led to smartvault[.]im, a look-alike of the real SmartVault document platform, sitting behind Cloudflare checks meant to keep automated scanners out. After a fake verification animation, the victim received TranscriptViewer5.1.exe. It was a repackaged ScreenConnect build signed by ConnectWise. Once it ran, an operator had a remote session, a path to credentials, and a beachhead for whatever came next. No ransom note. No splash screen. Just a help-desk tool pointed the wrong direction.

The Hacker News made the targeting explicit. This was not a spray at random households. It was aimed at people whose workday is a pile of tax attachments. That is a different problem than a refund QR code sent to a personal Gmail account, though both showed up in the same season. Endpoint products that hunt for unknown junk will shrug at a vendor IT already allows. A preparer who thinks the IRS just handed over a viewer will click. The rest of the compromise is quiet.

When One Brand Got Hot, the Kits Changed Brands

Follow-on waves on February 23 and 27 used the subject line “IR-2026-216,” Eventbrite-styled IRS branding, and a “Cryptocurrency Tax Form 1099” lure aimed at higher education. Domains such as irs-doc[.]com and gov-irs216[.]net dropped IRS-doc.msi files that installed ScreenConnect or SimpleHelp. Variants aimed at accounting firms installed Datto. Microsoft’s researchers noted the same industry trend Huntress had quantified: remote-management abuse up sharply year over year, sometimes daisy-chained so that no single vendor’s telemetry tells the whole story. Elastic Security Labs researchers Daniel Stepanic and Salim Bitam put the design in one sentence. These tools are already trusted inside corporate networks, so they do not trip the alarms reserved for unknown binaries.

Credential theft ran beside the installers. A kit tracked as Energy365, estimated to push hundreds of thousands of messages a day, wore CPA branding. SneakyLog, also tracked as Kratos, hid QR codes in personalized W-2 attachments that opened fake Microsoft 365 logins and captured multifactor codes. The IRS Dirty Dozen for 2026 again listed impersonation by email and text at the top and repeated the only rule that has stayed true: the agency does not start contact by unsolicited email, text, or social media to demand data or payment. That reminder lives on IRS.gov. It has lived there for years. The inboxes still open.

Item eleven on that Dirty Dozen list is the quiet one. It describes “new client” and “document request” mail that delivers malware and steals client files. The February 10 blast was that item at industrial scale. The agency also reported more than 600 social-media impersonators during fiscal 2025. None of those accounts needed a ScreenConnect binary. They needed a logo and a deadline.

The July Chain Did Not Even Need the IRS Logo

By summer the costume had loosened. A July incident advisory circulated by CyberHoot, tagged CH-TA-2026-0001, described a preparer who was approached as a prospective client named “Teresa Bair.” The first contact came through the firm’s own website form. Rapport lasted weeks. A “tax meeting” produced a Microsoft Teams link whose visible text read teams.microsoft.com while the real address enrolled the workstation into an attacker-controlled Rippling device-management tenant. Scripts then ran as SYSTEM and tried to plant a second ScreenConnect instance plus FleetDeck, a backup remote tool, so that killing one brand would leave the other. That is the daisy chain in practice, not in a slide.

August brought a different wrapper and the same payload. LevelBlue’s OpsCTI team, writing on August 7, described a large phishing run that impersonated the Microsoft Store and the Apple App Store. Fake update dialogs for Google Meet, Adobe Acrobat, Teams, Zoom, DocuSign, and other ordinary work tools offered an unauthorized ScreenConnect client. No tax form. No EFIN. Just a box that looked like software the user already meant to install. On September 4, security researcher Vladimir Khoetsyan described a related chain in public: a tax lure, an encrypted zip, a Visual Basic script, PowerShell, and a signed installer for ScreenConnect or GoTo Resolve. He said 94 percent of about 240 hosts in that set lived only a day, which is why blocklists lose. The install is the signal. A remote-access agent nobody in IT ordered is the incident.

A September 10 briefing from the hosting firm Verito still used the February transcript-viewer campaign as the example preparers should memorize: 14 rotating sender names, a fake EFIN review, a SmartVault look-alike, a signed remote tool. The calendar had moved. The template had not. Quarterly estimated payments in September and January keep the same anxiety in the same mailboxes. A partner who ignored a transcript viewer in February will still open a notice of underpayment in the fall. Attackers rent sending infrastructure again. They change the subject line. The signed binary stays because the trust stays.

A Tax Mailbox Is Worth More Than One Refund

Preparers hold Social Security numbers, bank routing numbers, and prior-year returns for entire client lists. One mailbox takeover funds refund fraud and the kind of downstream identity theft documented in the 700Credit breach that exposed nearly 6 million car buyers. Microsoft’s researchers noted that the professionals in the blast were “accustomed to receiving tax-related emails during this period,” which is exactly why the lures work. CISA, the NSA, and MS-ISAC have already warned that portable remote-management executables can run as a local user without a full install, a path used against federal civilian networks. A firm that banned ScreenConnect in February and never looked for SimpleHelp, Datto, FleetDeck, or GoTo Resolve in May did not close the campaign. It changed the costume.

The same habit shows up across The AEGIS Alliance cyber file: borrow something people already trust, then empty what it can reach. That is the shape of the Phantom Hacker bank-drain warning, the Treasury remote-access incident, and the shadow network Google said had been riding ordinary phones. Different brands. Same idea.

What Actually Shrinks the Next Wave

Multifactor authentication on mail and financial accounts, conditional access that blocks odd sign-ins, and a written ban on installing any remote-access tool IT did not request are the minimum. Staff should open IRS accounts by typing the official address, never by clicking a button in a message. Suspicious mail can go to ph******@*rs.gov. Endpoint tools need to flag the first time ScreenConnect, SimpleHelp, Datto, FleetDeck, LogMeIn, or GoTo Resolve appears on a machine, not just unsigned junk.

Accounting shops should treat a surprise “transcript viewer” the way a bank treats a surprise wire. Call the person who is supposed to have sent it, on a number already on file. Do not call the number in the email. Do not run the file “to see if it looks real.” A signed ConnectWise binary that nobody ordered is not a tool. It is a key. Cleanup that only uninstalls the brand named in a blog post is theater. Pull every unexpected remote-access service, rotate the credentials that lived on that box, and treat every token on the machine as burned. The AEGIS Alliance will keep following how impersonation campaigns migrate from a filing deadline to whatever deadline comes next, on the hacker news and U.S. news desks.

The IRS logo was wrapping. Trust was the product. Anyone still reading the danger as a problem that ended on Tax Day is watching the calendar instead of the installer.