"This scam is targeting tax professionals and firms, attempting to steal highly sensitive client information, and, frankly, it's not surprising," Mike Wyatt, threat researcher, at San Francisco based digital threat management firm RiskIQ, said. He explained cybercriminals often leverage holidays, events, and other important dates in their threat campaigns, so it makes perfect sense to capitalize on the extended tax deadlines coming up. "Ultimately, getting people to click on their links requires social engineering, and leveraging themes and holidays is a reliable tactic for them."

In 2016, RiskIQ detected approximately 58 million incidents, or 158,904 a day. There was a clear spike between late February and mid-April, the height of income-tax return season. And it looks like threat actors are now taking advantage of 2017's extended deadlines.

Wyatt pointed out the threat actors use convincing branding, language, and URLs to make phishing attempts more realistic and more difficult for users to quickly determine the email's authenticity. However, most brands remain unaware of how their branding's use in threat campaigns across digital channels. even though the legitimate brands, like the tax software providers in this instance, have nothing to do with the threat campaigns, many customers will still blame them.

Wyatt suggested companies should have a complete, adaptive and continuous inventory of their entire digital footprint to protect their reputation and their customers' confidence in them.