Fake Israel Tax Authority Emails Deliver SimpleHelp RMM to Israeli Targets
First merged summary.
Phishers impersonate Israel's Tax Authority to install SimpleHelp remote access software on Israeli organizations since September 2026.
Since September 2026, attackers have sent phishing emails to Israeli organizations impersonating the Israel Tax Authority. Victims clicking links reach fake government sites hosting SimpleHelp client version 5.4.5, pre-configured for attacker control via remote access. No vulnerabilities were exploited, relying solely on social engineering. Cato Networks traced the infrastructure but could not confirm MuddyWater attribution despite historical links to similar campaigns.
- Campaign observed since September 2026 targeting Israeli organizations
- Impersonates Israel Tax Authority using gov.il domains
- Delivers SimpleHelp client version 5.4.5 configured for attackers
- Targets finance and administrative staff
- Uses fake websites and CAPTCHA checks
- No software vulnerabilities exploited
What each outlet adds
beyond the shared facts- GBHackersSuspects MuddyWater and mentions Hebrew tax documents
- Cyber Security NewsSpecifies SimpleHelp version 5.4.5 and CAPTCHA checks
- Vendors
- SimpleHelp
- Threat actors
- MuddyWater
- Victims
- Israeli organizations
- Organizations
- Cato Networks
- Countries
- Israel
Coverage
oldest first · one row per article · UTC- · 6d ago
GBHackersFirst report
MuddyWater Suspected in Fake Tax Authority Phishing Campaign
MuddyWater suspected of targeting Israeli organizations with tax-themed phishing emails leading to SimpleHelp remote access installation.
- · 6d ago
Cyber Security News
Hackers Use Fake Government Websites to Deliver SimpleHelp
Phishing campaign impersonates Israel Tax Authority to install SimpleHelp remote access software on Israeli targets.