Fake Israel Tax Authority lures deliver SimpleHelp remote access software
PHISHINGIsrael Tax Authorityredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
A campaign since September 2026 impersonates the Israel Tax Authority through phishing emails and lookalike websites with CAPTCHA-style checks, leading staff to download a password-protected ZIP containing an executable. The payload deploys legitimate SimpleHelp remote access software configured to connect to attacker infrastructure, and Cato Networks suspects a link to MuddyWater without definitive attribution. Cato found no evidence of a software vulnerability being exploited; the entry point was social engineering using SimpleHelp Remote Access Client 5.4.5.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Block the listed campaign domains and IP addresses at the network perimeter.
- Search endpoints for unauthorised SimpleHelp remote access clients and investigate any found, including version 5.4.5.
- Warn finance, accounting and administrative staff not to open archives or run executables from unexpected tax authority emails.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Cyber Security News
Who and what is in it
Products
Government agencies