Tax-related themes are frequent lures for phishing emails and websites. Sunnyvale, Calif.-based Proofpoint revealed cybercriminals expanded their attack methods this tax season to include ransomware, malware, malicious documents, and social engineering.

In a blog the cybersecurity firm reported scammer expansion beyond traditional phishing lures to get sensitive information access. These additional attack methods include using email subject lines, which highlight a new IRS policy, a loyalty tax refund, and electronic filing; posing as tax companies to steal personal details; and a recent campaign promising a quick online refund process after providing bank account information.

Proofpoint reported tax-themed email campaigns encapsulate the broader trends highlighted in its 2016 Threat Report: large-scale distribution of ransomware via email, geographic targeting of banking Trojans, variation of payloads, and increasing adoption of URLs in place of document attachments.