Elon Musk, the IRS, and Your Bank Account: Anatomy of a Multi-Stage Financial Scam

What Happened

Scammers are sending fake emails pretending to be the IRS, offering a $5,000 tax refund tied to an Elon Musk cryptocurrency program. Anyone who clicks the link is taken to a fraudulent website that steals sensitive personal information, including bank account details and photos of government IDs. This stolen information can be used by the attackers to drain bank accounts or commit severe identity theft. Users should be highly suspicious of unsolicited emails offering unexpected money and should never provide banking details or ID photos to unverified websites.

Key Takeaways

• A multi-stage phishing campaign spoofs the IRS and Elon Musk to offer a fake $5,000 tax refund.
• The attack harvests extensive PII, including government ID scans and bank routing numbers, enabling severe identity theft and financial fraud.
• Victims are redirected to a fraudulent cryptocurrency dashboard ('ElonMusk Dogecoin Initiative') that encourages weekly Bitcoin deposits.
• The fake platform enforces a three-month dwell time for withdrawals, maximizing the window for threat actors to steal funds.
• Stolen credentials and PII are exfiltrated to a threat actor-controlled Telegram bot.

Affected Systems

• End-user email accounts
• Online banking accounts
• Cryptocurrency wallets

Attack Chain

The attack begins with an email spoofing the IRS, containing a link to a credential phishing site. Victims are lured with a fake $5,000 tax refund and prompted to enter extensive PII, which is exfiltrated to a Telegram bot. The victim is then redirected to a fraudulent cryptocurrency dashboard where they are socially engineered into providing government ID scans, bank routing numbers, and direct Bitcoin deposits under the guise of an 'ElonMusk Dogecoin Initiative'.

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No

The article does not provide specific detection rules or queries.

Detection Engineering Assessment

EDR Visibility: None — This is a web-based phishing and social engineering attack that does not involve dropping malware or executing malicious processes on the endpoint. Network Visibility: Medium — Network telemetry can capture DNS requests to the phishing domains and potential data exfiltration traffic to the Telegram API. Detection Difficulty: Moderate — Detecting this relies heavily on email security gateways catching the initial spoofed lure and web proxies blocking newly registered or uncategorized domains.

Required Log Sources

• Email Gateway Logs
• Web Proxy Logs
• DNS Logs

Hunting Hypotheses

Control Gaps

• Email Security Gateway (SEG) bypass
• Lack of web filtering for newly registered domains

Key Behavioral Indicators

• Emails spoofing government entities (IRS) but originating from non-government sender domains
• Web forms requesting bank routing numbers and government ID uploads simultaneously

False Positive Assessment

• Low

Recommendations

Immediate Mitigation

• Verify against your organization's incident response runbook and team escalation paths before acting.
• Block the identified domains (irsdogeelon.com, dogetaxcoin.com) on web proxies and DNS firewalls.
• Search email gateways for messages from [email protected] and purge them from user inboxes.

Infrastructure Hardening

• Implement strict DMARC, SPF, and DKIM verification to flag or block spoofed government emails.
• Evaluate whether newly registered domains can be isolated or blocked by default in your web proxy.

User Protection

• If supported by your tooling, implement browser-based phishing protections to block known malicious URLs.

Security Awareness

• Educate users on the dangers of unsolicited financial offers and the importance of verifying government communications through official channels.
• Train employees to never upload government IDs or provide bank routing numbers to unverified third-party websites.

MITRE ATT&CK Mapping

• T1566.002 - Phishing: Spearphishing Link
• T1036.008 - Masquerading: Masquerade Task or Service
• T1056.002 - Input Capture: GUI Input Capture
• T1567.002 - Exfiltration Over Web Service

Additional IOCs

• Domains:
  • irsdogeelon[.]com - Phishing domain hosting the fake cryptocurrency market.
  • dogetaxcoin[.]com - Domain associated with the fraudulent customer support email address.
• Urls:
  • hxxps://irsdogeelon[.]com/application.html - Initial credential phishing page.
• Other:
  • bc1pfxf9e57tuptfme0gwhmnk2kuqdyl4r984knejymtv5dfdk7h5dcqet4796 - Threat actor Bitcoin address provided for fraudulent deposits.