Tax Phishing - PDF to Captcha Web Redirect (T1204.001)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•4

Identifies PDF readers spawning web browsers that navigate to intermediary Cloudflare/reCAPTCHA domains, which are often used to mask the actual phishing landing page in tax-related phishing campaigns.