2026 Tax Season Threat Report
How an organized IRS and CRA impersonation campaign is targeting taxpayers, employees, and enterprise platforms this tax season.
An organized fraud campaign is impersonating the IRS and Canada Revenue Agency this tax season, running ahead of last year’s pace. Bolster AI’s research team tracked the full chain: bulk domain registration, trusted platform abuse, cross-platform malware, and an underground ecosystem converting stolen credentials into cash at scale.
Download the report now to uncover:
Why 82% of newly registered IRS-themed domains are already active and malicious
How attackers are abusing Docusign, Coda, ID.me, and free hosting platforms to bypass email security
The escalation from credential theft to malware distribution targeting Windows and macOS
Underground cash-out services advertising 40-45% commission on stolen refunds
Specific risk exposure for HRIS, payroll, tax compliance, and consumer tax platforms
