Hackers Use Tax Phishing Emails to Deploy In

Cybersecuritynews •Tushar Subhra Dutta • June 10, 2026

Hackers are using fake tax notification emails to trick Windows users into downloading dangerous multi-stage malware that runs entirely in memory, leaving almost no trace behind. The campaign, tracked as Operation TaxShadow, has been active since at least May 20, 2026, targeting individuals by impersonating official Indian government tax authorities. The emails are crafted to create […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Tax Phishing Campaign Deploys In-Memory Malware Targeting Windows Users Cybercriminals are executing a tax-themed phishing campaign, using emails that impersonate official tax notifications to deliver sophisticated in-memory malware on Windows systems. Victims receive emails with malicious attachments disguised as tax documents, such as W-2 forms or notifications from government entities. This campaign, identified as Operation TaxShadow, has been active since May 20, 2026, primarily targeting individuals in India. The malware operates entirely in memory, evading traditional detection methods and leaving minimal traces. The attack is part of a broader trend of using social engineering tactics to exploit tax season vulnerabilities. As of June 10, 2026, the campaign continues to pose a significant risk to users who may fall for these phishing attempts. 2 sources 64

Extracted Entities

Hackers Use Tax Phishing Emails to Deploy In

The full story

Extracted Entities

Attack Types (2)

Campaigns (1)

MITRE ATT&CK (2)

Platforms (1)