Author: Jackson Godwin
Email: info@jacksontechnology.com.ng
Date: June 2025

Every tax season, cybercriminals get to work too — and this year, they've upgraded their tactics. A new wave of phishing campaigns is using tax-related emails to deliver malware that runs entirely in your computer's memory, leaving almost no trace on your hard drive.

WHAT'S HAPPENING?
Security researchers have identified a surge in phishing emails disguised as tax refund notifications, FIRS (or IRS) alerts, and accounting software updates. But what makes this campaign particularly dangerous isn't just the lure — it's the payload.

Once a victim clicks the malicious link or opens the attachment, the malware does something unusual: it never writes itself to the hard drive. Instead, it loads directly into RAM — the computer's working memory — and executes entirely from there. This technique is known as fileless malware or in-memory execution.

WHY THIS MATTERS: Most traditional antivirus software looks for malicious files on disk. If there's no file, there's often no detection. The malware runs, steals data, and can vanish before anyone notices.

HOW THE ATTACK WORKS

Step 1 — The hook
The victim receives a convincing email — often mimicking a government tax agency, a well-known accounting platform, or their company's finance team. The subject line might read: "Your 2024 Tax Refund is Ready" or "Urgent: Unresolved Tax Filing Error."

Step 2 — The trigger
The email contains either a malicious link or an attachment (often a PDF or Office document). Clicking it triggers a script — usually PowerShell — that runs directly in the Windows shell without downloading any executable file.

Step 3 — In-memory execution
The script pulls malicious code from a remote server and loads it directly into the system's memory. Tools like Reflective DLL Injection or Process Hollowing are commonly used to inject the payload into a legitimate Windows process, making it nearly invisible.

Step 4 — The damage
Once active, the malware can harvest credentials, log keystrokes, establish a remote backdoor, or move laterally across the corporate network — all without ever creating a file that a traditional AV scanner would catch.

WHY FILELESS MALWARE IS SO DANGEROUS
Traditional security tools rely heavily on scanning files. When there are no files to scan, the threat goes undetected. Fileless malware also takes advantage of trusted, built-in Windows tools like PowerShell, WMI, and mshta.exe — a technique known as Living off the Land (LotL) — which makes it even harder to distinguish malicious activity from normal system operations.

HOW TO PROTECT YOURSELF AND YOUR ORGANISATION

• Deploy EDR (Endpoint Detection & Response) solutions that monitor behaviour, not just files
• Restrict PowerShell execution policy — use Constrained Language Mode where possible
• Enable Script Block Logging in Windows to capture PowerShell activity
• Train staff to verify tax-related emails through official channels before clicking anything
• Apply the principle of least privilege — limit which users can run scripts
• Use email security gateways that inspect links and attachments in sandboxed environments
• Patch regularly — many fileless attacks exploit unpatched vulnerabilities to gain initial access

FINAL THOUGHTS
Tax season is a gold mine for social engineers. Combine urgency, financial anxiety, and a convincing email template — and you have one of the most effective phishing lures of the year. The shift toward fileless, in-memory malware means that organisations relying solely on legacy antivirus solutions are flying blind.

The good news? These attacks are detectable — just not with yesterday's tools. Behavioural monitoring, PowerShell logging, and a well-trained workforce remain the strongest lines of defence against campaigns like this.

Stay alert. Question every unexpected tax email. And if something feels off — it probably is.

Found this useful? Share it with your team. Cybersecurity awareness starts with conversations like this.
Questions or enquiries? Reach out at info@jacksontechnology.com.ng