Hackers Abuse Legitimate RMM Tools in The Quarry IRS and SSA Phishing Campaigns

Cybersecuritynews •Tushar Subhra Dutta • June 16, 2026

A wave of phishing campaigns targeting American taxpayers has been traced back to a single, highly organized cybercrime operation known as The Quarry. What appeared to be dozens of unrelated incidents impersonating the IRS, Social Security Administration, and platforms like DocuSign turned out to be the work of one developer selling a Phishing-as-a-Service (PhaaS) toolkit […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Quarry PhaaS Ecosystem Targets U.S. Taxpayers with IRS Phishing Campaigns A cybercrime operation named The Quarry has been identified as the source of numerous phishing campaigns targeting American taxpayers. These campaigns impersonate the IRS and SSA, exploiting a Phishing-as-a-Service (PhaaS) toolkit developed by an individual known as RockyBelling. Research from SOCRadar indicates that nearly 200 affiliates are utilizing this modular toolkit, which features advanced cloaking and real-time victim telemetry. The campaigns have been active from April 2025 to April 2026, affecting a significant number of U.S. victims. Legitimate remote management tools are being abused in these attacks, complicating detection efforts. The operation's organized nature suggests a high level of sophistication and coordination among the affiliates. Current status indicates ongoing phishing attempts as the toolkit remains in use. 2 sources 64

Extracted Entities

Hackers Abuse Legitimate RMM Tools in The Quarry IRS and SSA Phishing Campaigns

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

MITRE ATT&CK (1)

Tools (3)