Volgograd residents were told about malicious mailing on behalf of the tax service

In September 2026, Kaspersky Lab specialists recorded a massive malicious mailing dedicated to the recalculation of the personal income tax for 2025. The attackers sent letters allegedly on behalf of official agencies. Recipients were informed of the identified debt and demanded urgent clarification of personal data. More than 400 such messages were sent in just three days. According to experts, such mailings are becoming more sophisticated, and even experienced users can become victims.

Deception scheme

According to Kaspersky Lab, the letters use the topic of progressive taxation. The senders claim that after the automated recalculation, a discrepancy between the amount of income received and the accrued tax was found. The report provides specific amounts of allegedly accrued and paid tax, as well as the amount of debt. The recipient is warned: if he does not provide clarifications within the prescribed period, the debt can be forcibly recovered with the accrual of penalties. To verify the data, a person is offered to follow the link, download and study the attached documents. To identify allegedly need to enter TIN and SNILS, as well as confirm the operation code from SMS.

Fraudsters often use official logos and similar email addresses to lull vigilance. They expect that reporting a debt and possible enforcement will prompt a person to act hastily without checking the information.

The danger of investing

In addition to the link in the letter is an archive with malicious software. Its launch can lead to infection of the device with Trojan software. Experts note that attackers follow the current agenda and use it to create convincing legends. In this case, they exploit the topic of the upcoming declaration period. The Trojan can steal passwords, bank details and other sensitive information.

If the archive is already open, you must immediately check the device with an antivirus and, if necessary, contact the service center. You should also change the passwords for important accounts, especially if they match the data entered on the phishing page.

How to protect yourself

Anna Osipova, senior spam analyst at Kaspersky Lab, recommends being critical of unexpected emails, including those that come under the guise of official notifications. Do not click on links and open attachments from suspicious messages, even if the sender is in a hurry or threatens negative consequences. Information on tax accruals and arrears should be verified independently through official resources.

It is worth remembering that these notifications from the tax service do not come in the form of archives with a requirement to urgently enter personal data. Financial information and personal data require special care. Scammers are constantly improving their schemes, so vigilance is the main protection.

It is also recommended to configure two-factor authentication on important resources and regularly update antivirus databases. If you receive such an email, it is best to delete it without opening the attachments and report the attempted fraud to the bank or law enforcement.