The American Rescue Act is the latest zeitgeisty lure being circulated in an email campaign. The emails impersonate the IRS, using the agency s official logo and a spoofed sender domain of IRS[.]gov and claim to offer an application for financial assistance. In reality, the emails offer the Dridex banking trojan, which has been deployed via phishing emails and generally targets banking information. Users are prompted to enable content to see the supposed IRS form in its entirety, but if they do, they trigger macros that set off the infection chain.
Source: https://threatpost.com/covid-19-relief-checks-dridex-malware/164853/