On 3 November 2026, the research unit of security company Cato Networks published findings on a phishing campaign aimed at businesses and organizations in Israel that impersonates the Israel Tax Authority. The researchers say the emails have been going out since at least September 2026. They are aimed mainly at people who work in finance, bookkeeping and administration, the staff who open tax-related documents every day. That habit is what the attackers count on.
The Tax Authority itself has issued no warning. Its own announcements from the same week do not mention the campaign.
From the email to the file
The message looks like an official Tax Authority notice and invites the recipient into their "personal area". The link does not go to the government site. It goes to a lookalike site at one of several addresses registered to look official: doc-taxes-govil.org, document-govil.com, doc26-govil.org and document-govil.online.
The site shows a "verification" step that resembles a CAPTCHA: a checkbox, a Continue button and a fixed password, 123123. It checks nothing. Its job is to make the process feel like a secure document delivery. At the end a ZIP file downloads, named something like Israel_Tax_Authority.zip or document.zip. Inside is a program file called "רשות המסים בישראל.exe" (Hebrew for "Israel Tax Authority") or document.exe.
After a double click
The file installs SimpleHelp, a legitimate remote support tool, in an old version (5.4.5). The installation is set up in advance to connect to the attackers' server. From then on they have full control of the computer, and from there they can move on to the other machines on the business network.
The attackers did not break into the software itself. The researchers reported the campaign to SimpleHelp on 20 October, and the company said it had seen no exploited vulnerability on its side. The attackers simply put a legitimate tool to malicious use, and what lands on the computer is a well-known support program.
The researchers suspect MuddyWater, an attack group linked to Iran's Ministry of Intelligence and Security. They base that on the mix of Israeli targets, impersonation of an Israeli authority and remote access software delivered by phishing, a pattern documented for the group before. The attribution has not been confirmed.
Signs the email is not from the authority
A government website address ends in gov.il. An address like document-govil.com is a different domain altogether, one that someone paid to register. The letters "govil" inside the name do not make it official.
A tax document is a PDF or a form inside the personal area. A file ending in .exe is a program, even when it is called "Israel Tax Authority". The same goes for a ZIP file that opens with a password printed on the site that delivered it.
Anyone who gets an email like this and wants to know whether something really is waiting at the authority should type the Tax Authority's address into the browser themselves and log in to the personal area from there, without clicking the link in the email.
A business with staff should pass this description to whoever opens the bookkeeping mail. In a small office that is usually the owner or the outside bookkeeper, and they are exactly who this campaign is after.
If someone already ran it
A computer that ran a file like this has to come off the network straight away: unplug the cable or turn off Wi-Fi. Then check the list of installed programs for SimpleHelp, software nobody in the business installed. If it is there, the attacker has most likely got in.
Change the passwords for the bank, email, the accounting software and the Tax Authority personal area from a different device, not from the affected computer. A business that works with an IT person or a support company should bring them in the same day, because whoever reached one computer can try for the server and the backups next.