Tax Phishing Campaign Deploys In-Memory Malware Targeting Windows Users

• •Operation TaxShadow targets Windows users with tax-themed phishing emails.
• •The malware operates entirely in memory, avoiding traditional detection mechanisms.
• •The campaign has been active since May 20, 2026, primarily affecting individuals in India.

Cybercriminals are executing a tax-themed phishing campaign, using emails that impersonate official tax notifications to deliver sophisticated in-memory malware on Windows systems. Victims receive emails with malicious attachments disguised as tax documents, such as W-2 forms or notifications from government entities. This campaign, identified as Operation TaxShadow, has been active since May 20, 2026, primarily targeting individuals in India. The malware operates entirely in memory, evading traditional detection methods and leaving minimal traces. The attack is part of a broader trend of using social engineering tactics to exploit tax season vulnerabilities. As of June 10, 2026, the campaign continues to pose a significant risk to users who may fall for these phishing attempts.