Fake Tax Recalculation Emails Spread Trojan Malware
In short: Kaspersky Lab has flagged a new wave of phishing emails disguised as a tax-authority notice about a personal-income-tax recalculation tied to Russia's new progressive tax scale for 2025. The emails claim a 'mismatch' between income and tax paid, urge recipients to open an attached archive, and ask them to enter a national tax ID, SNILS number, and an SMS code. The archive hides malware. The scheme was reported by RIA Novosti, Rossiyskaya Gazeta, and iXBT.
What happened
Between October 14 and 19, 2026, several major outlets — RIA Novosti, Rossiyskaya Gazeta, and iXBT — reported a new wave of malicious emails that Kaspersky Lab detected in September and October 2026: over 400 messages were sent in just three days in September alone. This is not the first tax-themed attack this year — in September, a similar scheme using paper letters was already circulating (see our article on tax-authority phishing letters), but this new wave uses a different channel: email with a malicious attachment.
How the scheme works
The email is formatted as an official tax-authority notice. It claims that, following the introduction of a progressive income-tax scale, an automatic recalculation found a mismatch between the recipient's income and the personal income tax (NDFL) assessed for 2025. The recipient is urged to resolve the 'debt' as soon as possible — a classic urgency trick designed to trigger panic and bypass critical thinking.
Victims are then offered two paths: click a link in the email, or download and open an attached archive of 'supporting documents.' Either way, the scammers' end goal is the same — harvest personal data and gain a foothold on the device. The fake page asks victims to enter their tax ID and SNILS number, then confirm the 'operation' with an SMS code — exactly how attackers bypass one-time-password protection and gain access to government-portal accounts. If the victim instead opens the attached archive, a trojan launches and embeds itself on the device, where it can be used to steal further data or provide remote access.
Why this attack works right now
The timing is deliberate: the shift to a progressive NDFL scale is a real, widely covered legislative change that Russian media reported on throughout 2026. When a topic is already on everyone's mind, an email about a 'technical recalculation' sounds plausible even to careful users — the scammers are riding a real news story rather than inventing one from scratch. It is the same trick used in September's paper-letter wave from the tax authority: tying a scam to an active legislative change sharply raises its conversion rate.
Asking for an SMS code instead of just a password is not an accident either. Two-factor authentication is usually considered strong protection, but it is useless if the victim types the one-time code into a phishing page in real time. For the attackers, the SMS 'confirmation' step is not an obstacle — it's an extra piece of the story that makes the scheme more convincing.
What to do if you received this email
Do not open attached archives or documents. The tax authority does not send recalculations as .zip or .rar archives by email — that alone is an immediate sign of phishing.
Do not click links in the email. If you need to check your tax status, open your personal account manually: lkfl.nalog.ru for the FNS or gosuslugi.ru for Gosuslugi. Do not copy the address from the email.
Never enter an SMS code on a third-party page. That code is meant to confirm your own action inside an official service, not to 'confirm' someone else's request.
If you already opened the file, disconnect the device from the network, run a full antivirus scan, and change passwords for key accounts from a different, uninfected device. Our guide on checking for a personal-data leak walks through the next steps.
Use a password manager with unique passwords for every service, so that one compromised account doesn't open the door to the rest — see our guide to choosing and using a password manager safely.
Protect your connection on public networks. Checking email from a café, airport, or hotel risks having your traffic intercepted on the same Wi-Fi network. LiMP VPN encrypts your connection on Android, Windows, and Chrome under a no-logs policy, so the service itself keeps no record of your sessions. See pricing.
Sources
Frequently asked questions
How do I tell a genuine FNS recalculation notice from phishing?
The real FNS does not send document archives by email or ask for an SMS code to 'confirm' a recalculation via a link in a message. Check your tax status only through lkfl.nalog.ru typed manually into the address bar, or call the free helpline 8-800-222-22-22.
I opened the attached archive — what should I do now?
Immediately disconnect the device from the internet, run a full antivirus scan, change passwords for key accounts from a different device, and enable two-factor authentication wherever it's missing. If you suspect data theft, check whether any loans have been taken out in your name.
Will a VPN protect me from this phishing email?
A VPN won't stop a phishing email or block a malicious archive you open yourself — it protects against traffic interception, not malware. But on public Wi-Fi, a VPN encrypts your connection so no one else on the same network can intercept your data while you check email or log into an account.