Cofense researchers spotted a phishing campaign that is targeting taxpayers in the United States to infect them with the Amadey malware. The phishing messages used in this campaign purport to be from the Internal Revenue Service (IRS), they claim that the recipient is eligible for a tax refund. The message urges the user to click the Login Right Here button to login to a fake IRS login page. The user will be informed of a pending refund and will be asked to download a document, print and sign it.”]
Source: https://securityaffairs.co/wordpress/91532/malware/amadey-irs-phishing.html