Attackers are impersonating the stock-trading broker using fake websites to steal credentials as well as sending emails with malicious tax files.
Source: Threadpost