Israel Tax Authority
Latest
Fake Israel Tax Authority lures deliver SimpleHelp remote access software
A campaign since September 2026 impersonates the Israel Tax Authority through phishing emails and lookalike websites with CAPTCHA-style checks, leading staff to download a password-protected ZIP containing an executable. The payload deploys legitimate SimpleHelp remote access software configured to connect to attacker infrastructure, and Cato Networks suspects a link to MuddyWater without definitive attribution. Cato found no evidence of a software vulnerability being exploited; the entry point was social engineering using SimpleHelp Remote Access Client 5.4.5.
Suspected MuddyWater phishing campaign targets Israeli organisations with fake tax emails
Israeli organisations have been targeted since September 2026 in a phishing campaign impersonating the Israel Tax Authority. The lures distribute SimpleHelp remote monitoring and management software disguised as tax documents, rather than exploiting software vulnerabilities. Investigators suspect MuddyWater, citing the targeting and the group's documented abuse of legitimate remote-access tools, but attribution remains unconfirmed.