Tax Phishing - Malicious Word Macro Dropping Loader (T1204.002)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•1

Detects users interacting with Tax-themed phishing lures (e.g., W2, 1099, Tax Return) where Microsoft Word executes a macro that drops an executable to disk.