Researchers mapped a global phishing operation impersonating tax authorities in more than 30 countries, with localized lures timed to national filing deadlines.
The campaign sends convincing refund notifications and audit warnings that direct victims to cloned government portals harvesting credentials, identity numbers and banking details.
Infrastructure analysis links the operation to a single criminal syndicate running templated kits with per-country customization, hosted on rapidly rotating domains registered through resellers with lax verification.
Tax agencies in affected countries have issued public warnings, reminding citizens that refund notifications are never sent with embedded payment links.
