A coordinated IRS-themed phishing campaign documented by Microsoft Threat Intelligence on February 10, 2026, targeted more than 29,000 users across 10,000 organizations during tax season. Attackers harvested Microsoft 365 credentials and then installed legitimate remote monitoring and management tools, ConnectWise ScreenConnect, Datto RMM, and SimpleHelp, to maintain persistent backdoor access without deploying traditional malware. The business risk is significant: compromised RMM tools grant attackers ongoing remote control of affected endpoints, bypassing most endpoint and email security controls, and the signed nature of these tools means they are whitelisted in many environments.