Do Son Proofpoint found the PackClient RAT sold on Telegram and used by Chinese-speaking TA4922 malware operators in tax-themed phishing attacks.
TA4922
Read this Proofpoint cybercrime analysis on the surge of TA4922 malware campaigns targeting organizations globally with advanced evasion tactics.
Proofpoint identifies a surge in 2026 tax scams using RMM tools (39%) to bypass security. Learn how TA4922 and TA2730 target your data this filing season.