A newly discovered Emotet campaign aims to manipulate US taxpayers into clicking malicious links or downloading fraudulent attachments that promise to contain W-9 forms.

The first few months of the year are busy for both taxpayers and cybercriminals, who capitalize on the season with phishing emails related to filing taxes and collecting returns. This campaign relies on victims to view a W-9 form, an essential form that taxpayers need to file their US taxes.

These phishing messages are not complex, report the Cofense researchers who discovered the attack. Some emails arrive with an attachment; others contain a simple link to download the document. Both forms of the attack deliver Emotet to the recipients. 

"While this tax season is just getting started, with many tax filing forms due to taxpayers last week, by Jan 31st, we anticipate these campaigns will likely evolve and get better as we move towards the annual filing date of April 15th," writes Cofense's Tonia Dudley in a blog post.

Experts advise protecting against these types of attacks by filing tax returns early, using a secure Internet connection to file electronically, and checking credit reports at least once per year. Taxpayers should also protect their Social Security number throughout the year and thoroughly research tax preparers before sharing their personal information.  

Read more details in the full post here.

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "C-Level & Studying for the CISSP."