Fake new client wants you to assess an ‘IRD letter’.
A social engineering campaign targeting accounting firms has been detected. Scammers masquerade as new clients seeking professional guidance on a fictitious IRD letter.
Decision1 monitoring has identified a sophisticated social engineering lure specifically targeting local accounting firms. The attacker, posing as a prospective client named 'Lisa Krupp', claims to have received an urgent letter from the IRD and requests an initial assessment. This 'low and slow' tactic is designed to build trust before delivering a malicious attachment or link disguised as the IRD document. Organisations are urged to verify new enquiries through established out-of-band channels before opening any files.
Source: Decision1 Internal Intelligence
The domain the message claims to be from. Fresh registrations and known-bad reputations are the strongest technical tells of a spoofed sender.
