The Taxman Never Sleeps

Although claiming to be from IRS, the phishing email originated from an organization’s compromised email account in Pakistan. The subject and body claim that the recipient’s IRS K-1 forms are attached in a Zip file encrypted with the password “0440”.