Recently, threat actors operating out of the Tactical Octopus organization have been observed targeting individuals throughout the United States with tax-themed phishing emails. These carefully crafted phishing emails utilize lure documents such as real estate contracts, I-9 forms, and W-2 forms to entice users into unknowingly downloading malicious payloads to their device. The malicious code executes once the user extracts an attached password protected .ZIP archive containing a malicious LNK file that enables the download of a .VBS (Visual Basic Script) file. During execution of the .VSB file, the malicious code will reach out to an actor-controlled command-and-control (C2) server to pull down additional payloads to the system. Heavily obfuscated to evade anti-virus applications, these malware files contain several lines of unrelated comments and phrases to throw off detection algorithms. Furthermore, additional obfuscated PowerShell commands are executed on the system and show relation to code structures from a range of well-known malware such as Cobalt Strike and the “Kovter” RAT. IP addresses observed from C2 communications and malicious code show ties to Russian-hosted Internet Service Providers (ISP), alongside some United States ISPs. CTIX urges users to validate the integrity of email correspondence prior to downloading any attachments or visiting embedded hyperlinks. CTIX continues to monitor threat actor activity worldwide and will provide additional updates accordingly.