Urgent: Tax Season Is a Goldmine for Cybercriminals—Why Securing Your Software Can’t Wait

This guest post was contributed by Devin Maguire, Senior Product Marketing Manager, Cycode

Tax season is always busy for taxpayers and the platforms and agencies supporting them. With large amounts of sensitive information being passed through tax software, it's no surprise that attackers ramp up efforts this time of year. But what’s different now is the growing complexity of the systems behind those platforms, and the cracks that can appear when attention is stretched thin. 

What makes this especially concerning is how interconnected everything has become. A single vulnerability or overlooked update in one piece of tax software doesn’t just affect that system; it can open the door to deeper issues. Attackers know that getting access to source code, credentials, or backend infrastructure can give them a foothold not just into one platform, but into some of the most sensitive data that taxpayers hold dear. Once tools are compromised, further risks exist for other tools, agencies, and partners, all built on similarly sourced software. When that chain is compromised, the impact isn’t isolated. It spreads.

The Rising Threat: How Hackers Exploit Tax Software

Cyberattacks targeting tax software aren’t new, but they’ve gotten quite sophisticated. Phishing scams and social engineering tactics have become harder to spot, especially when they mimic legitimate government communications and find strategic targets. Tax professionals and individuals are tricked into clicking malicious links or handing over credentials. Recently, Microsoft reported that a phishing campaign attempted to deliver the red-teaming tool BRc4 and Latrodectus malware while cosplaying as the IRS. Hidden under subjects such as the “Unusual Activity Detected in Your IRS Filing,” these attackers simply waited for someone to open the door. Once inside, the goal is data exfiltration: pulling sensitive personal and financial information such as Social Security numbers, bank details, and tax IDs, directly from backend systems.

While these phishing schemes have become a notable play with warnings being sent out and around to consumers, there is a much longer and more detrimental game afoot. Behind every platform is a web of tools, packages, and code often pulled from third-party or open-source sources. This is the software supply chain, and it has become a major risk. One weak link, like a misconfigured development environment or a vulnerable open-source dependency, can open the door to broader, more serious compromises. The damage often isn’t visible immediately, making it even harder to contain. The problem is that those components are easy to overlook, mainly when teams focus on meeting deadlines or keeping up with customer demand.

Once that compromised code is introduced into a development pipeline, it becomes part of the product, and from there, part of the broader ecosystem. According to the World Economic Forum, supply chain vulnerabilities are emerging as the top ecosystem cyber risk for large organizations, as 54% identified supply chain challenges as the most significant barrier to achieving cyber resilience. When you consider the amount of sensitive data that tax platforms handle, these supply chain breaches can stay quiet, which makes them dangerous. The risk becomes clear. It’s not just about keeping your systems secure; it’s about understanding how connected your tools, code, and partners are. A gap in one place can impact everything else. And in a time like tax season, when the stakes are already high, that’s not a chance organizations can afford to take.

Protecting data is integral to tax preparation; ransomware becomes a consistent concern. Attackers know that timing is everything, and locking systems during peak filing windows puts enormous pressure on companies to pay up. The potential consequences of missed deadlines, regulatory headaches, and damage to customer trust can push even the most prepared organizations into difficult decisions. These attacks aren’t just about money; they’re about control, and tax season gives attackers additional leverage.

ASPM and Why Visibility and Contextual Insight Matter

Preventing attacks on tax software starts with knowing what your application is made of, and where the risks are hiding. By gaining visibility into the application security posture, organizations can better understand how risks connect across the development pipeline and address vulnerabilities before they’re exploited. Most platforms rely on a complex web of open-source libraries, third-party packages, configuration files, proprietary code and environment variables. That’s why security can’t just focus on the surface. It must look deeper, into how the software is built, what components it relies on, and how sensitive data might be exposed.

Automated tools play an essential role here. Tracking this manually in a fast-moving continuous integration and continuous delivery (CI/CD) environment isn’t realistic. Application Security Posture Management (ASPM) helps make sense of sprawling signals, tying together vulnerability data, misconfigurations, hardcoded secrets, and other risks into a single, contextual view. Rather than relying on scattered tools or one-off scans, ASPM gives teams a unified view of their security posture. This insight is crucial in high-stakes environments like tax software, where even one breach can ripple across connected systems, clients, and institutions.

Good security hygiene also means tight control over who has access to what, and making sure permissions aren’t left open longer than necessary. Tools that can detect exposed secrets in code, enforce access governance, and correlate vulnerabilities across the software development lifecycle (SDLC) allow teams to reduce risk without slowing down development. With this kind of visibility and context, teams can make smarter decisions and reduce the risk of a small oversight leading to a breach.

Final Thoughts 

This tax season let's examine the present security gaps and the governance that we use to protect vital taxpayer information. While it may land on the individual to keep an eye out for phishing attempts, organizations and tax software companies have an even bigger role to play with much more drastic consequences. Simple vulnerabilities, left to their own devices, can leave organizations scrambling and taxpayers fending for themselves. 

Gaining proper visibility and continuous monitoring capabilities is the only way to ensure that providers enforce a strict policy to stop attacks before they start. That means understanding what code is being used, where it’s coming from, who has access, and where the most significant risks lie. It’s not just about plugging gaps after something goes wrong; it’s about building defensible systems from the start and keeping them active throughout the lifecycle.