IRS Impostor Mail Hit 29,000 Inboxes With Signed ScreenConnect and the Same Kits Are Still Useful After Tax Day

The April 15 filing deadline is behind us. The malware that rode in on fake IRS mail is not.

On March 19, 2026, Microsoft Threat Intelligence and Microsoft Defender Security Research published the campaign anatomy that security teams had already been seeing in their queues: tax-season mail dressed as refund notices, payroll forms, and EFIN alerts, split between credential-harvesting sites and payloads that install legitimate remote monitoring and management software. The flagship blast on February 10 reached more than 29,000 users at over 10,000 organizations. About 95 percent of the targets were in the United States. Two waves ran between 10:35 and 19:51 UTC. Financial services, technology, and retail absorbed the largest shares, but the intended inboxes clustered around accountants and tax preparers. The write-up lives on the Microsoft Security Blog.

The AEGIS Alliance is less interested in the calendar trick than in the payload choice. Attackers did not need a custom implant. They used software help desks already trust. That is why the same kits still matter in September, long after the last extension form left a desk.

The IRS Transcript Viewer Was ConnectWise With a Costume

Messages claimed irregular returns had been filed under the recipient’s Electronic Filing Identification Number and pointed to a “Download IRS Transcript View 5.1” button. Amazon SES sent the mail. The button led to smartvault[.]im, a look-alike of the real SmartVault document platform, sitting behind Cloudflare checks meant to keep scanners out. After a fake verification animation, victims received TranscriptViewer5.1.exe — a repackaged ScreenConnect build signed by ConnectWise. Once launched, operators had remote control, credential access, and a beachhead for whatever came next.

That is the design. A signed binary from a vendor that IT departments already allow through the door. Endpoint products that hunt for unknown junk will shrug. A user who thinks the IRS just handed them a viewer will click. The rest of the compromise is quiet. No ransom note. No splash screen. Just a remote session that looks, to a tired firewall, like a technician doing a job.

The Hacker News summary of the same research made the targeting explicit: the blast was not a spray at random households. It was aimed at people whose job is to open tax attachments. That is a different problem than a grandma clicking a refund QR code, though both showed up in the same season.

When ScreenConnect Got Harder, the Kits Switched Brands

Follow-on waves on February 23 and 27 used subject line “IR-2026-216,” Eventbrite-styled IRS branding, and a “Cryptocurrency Tax Form 1099” lure aimed at higher education. Domains such as irs-doc[.]com and gov-irs216[.]net dropped IRS-doc.msi files that installed ScreenConnect or SimpleHelp. Accounting-firm variants installed Datto. Microsoft’s researchers noted the same trend Huntress quantified industry-wide: RMM abuse up 277 percent year over year, sometimes daisy-chained so no single vendor’s telemetry tells the whole story. Elastic Security Labs researchers Daniel Stepanic and Salim Bitam put the problem plainly — these tools are already trusted inside corporate networks, so they do not trip the alarms reserved for unknown binaries.

Credential-theft kits ran in parallel. Energy365, estimated to push hundreds of thousands of messages a day, wore CPA branding. SneakyLog, also tracked as Kratos, hid QR codes in personalized W-2 attachments that opened fake Microsoft 365 logins and captured multifactor codes. The IRS Dirty Dozen for 2026 again listed impersonation by email and text at the top of the list and repeated the only reliable rule: the agency does not start contact by unsolicited email, text, or social media to demand data or payment. That reminder is on IRS.gov. It has been on IRS.gov for years. The inboxes still open.

The Dirty Dozen also flagged AI-enabled phone impersonation, social-media “tax hacks,” and spear-phishing aimed at tax professionals. Item eleven on that list is the quiet one. It describes “new client” and “document request” mail that delivers malware to steal client files. The February 10 blast was that item at industrial scale. The agency reported more than 600 social-media impersonators during fiscal 2025. None of those accounts needed a ScreenConnect binary. They needed a logo and a sense of urgency.

Why Tax Shops Remain the Prize After April

Preparers hold Social Security numbers, bank routing data, and prior-year returns for entire client lists. One mailbox takeover funds refund fraud and downstream identity theft of the kind documented in the 700Credit breach that exposed nearly 6 million car buyers. The professionals Microsoft described are “accustomed to receiving tax-related emails during this period,” which is exactly why the lures work. CISA, NSA, and MS-ISAC have already warned that portable RMM executables can run as a local user without a full install, a path used against federal civilian networks.

The new problem is calendar-blind. Extension season, amended returns, and the next estimated-payment cycle keep the same inboxes hot. Signed RMM binaries will still look like IT doing its job. Organizations that only locked down during March and April are leaving the same door on the latch. A firm that banned ScreenConnect in February and never checked SimpleHelp or Datto in May has not closed the campaign. It has changed the costume.

Quarterly estimated payments in September and January keep the same anxiety in the same mailboxes. A partner who ignored a fake transcript viewer in February will still open a fake “notice of underpayment” in the fall. Attackers know that. They rent Amazon SES again. They change the subject line. The signed binary stays the same because the trust stays the same.

The same pattern showed up in other The AEGIS Alliance cyber files, including the NGate NFC cloning kit, the Phantom Hacker bank-drain warning, and later reporting on how Chinese operators hit Treasury workstations in the Treasury remote-access incident. Different brands. Same idea. Borrow trust, then empty the account.

What Actually Reduces the Chance of a Second Wave

Multifactor authentication on mail and financial accounts, conditional access that blocks odd sign-ins, and a written ban on installing any remote-access tool that IT did not request are the minimum. Staff should open IRS accounts by typing the official address, never by clicking a button in a message. Suspicious mail can go to ph******@*rs.gov. Endpoint tools need to flag first-seen ScreenConnect, SimpleHelp, Datto, and LogMeIn installs, not just unsigned junk.

Accounting shops should treat a surprise “transcript viewer” the way a bank treats a surprise wire. Call the person who is supposed to have sent it on a number you already have. Do not call the number in the email. Do not run the exe to “see if it looks real.” A signed ConnectWise binary that nobody in IT ordered is not a tool. It is a key.

Help desks should also assume daisy-chaining. Huntress has described attackers stacking one RMM inside another so that killing ScreenConnect leaves SimpleHelp running. A cleanup that only uninstalls the brand named in a blog post is theater. Pull the unexpected remote-access services, rotate credentials that lived on that box, and treat every token on that machine as burned. The AEGIS Alliance will keep tracking how impersonation campaigns migrate from seasonal lures to whatever deadline comes next, including the broader pattern in hacker news and U.S. news.

Trust is the product. The IRS logo is just the wrapping. Anyone who still thinks the danger ended on April 15 is reading the calendar instead of the payload.