The Tax Man Cometh But Beware Of Fake IRS W-9 Forms Laced With Emotet Malware

A scary malware called Emotet could be coming to an inbox near you, so beware as you file your taxes this year. If you see an email looking suspiciously like what we're about to describe, do not open it.

Major malware app developer Malwarebytes announced a new phishing attack making its rounds just as U.S. taxpayers are busy getting their taxes done. Disguising as legitimate-looking emails with W-9 forms sent by the Internal Revenue Service, the malware Emotet is ready to pounce the moment its attachment is opened. 

Emotet is said to originate sometime around 2014 from Ukraine and is considered some of the most dangerous malware in circulation. Once installed by the unsuspecting user, Emotet sends spam emails or reply-chain attacks using the victims' mailboxes and installs further macros that can gain access to users' systems to deliver ransomware or other malicious payloads.


In this scenario, Malwarebytes shows what the perpetrating email looks like. At first glance, it seems to come from a legit email sender, with an unassuming subject line of "IRS Tax Forms W-9" and has official looking footers. However, it doesn't carry much text and contains a zipped attachment, titled "W-9 form.zip." The attached file is roughly 709 kB. Unzipped, the file contains a Word document called "W-9 form.doc" with a suddenly-inflated file size of 550MB. Malwarebytes states that MS Office files like this one that come in at 500MB or more are rarely legit. This file size inflation is a tactic used to fool many built-in virus/malware software that have a limit of file sizes that they can effectively scan.


Opening the file reveals the next red flag. The file attempts to run some macros, and because Microsoft disables running macros by default, potential victims will see the above message, coaxing them to enable macros.

As the tax dateline looms, we suggest that you be extra vigilant around suspicious emails such as the one above or those that promise you refunds via email correspondence. Don't feel pressured (and fall into) tax scammer traps—most tax-related filing/documentation is done on dedicated government portals, tax websites, and by mail.