Nigerian man gets eight years in prison for hacking tax firms
Source: Bleeping Computer
Case Overview
A Nigerian national was sentenced to eight years in prison for hacking multiple tax‑preparation firms in Massachusetts and filing fraudulent tax returns seeking over $8.1 million in refunds.
According to court documents, after gaining access to the companies’ systems, Matthew Abiodun Akande stole clients’ personal information and used it to file more than 1,000 fraudulent tax returns, collecting over $1.3 million in fraudulent refunds between June 2016 and June 2021.
Arrest and Extradition
- Arrest: October 2024 at London’s Heathrow Airport.
- Extradition: March 2025 to the United States.
- Indictment: Federal grand jury indictment in July 2022 while Akande was residing in Mexico.
Sources
Modus Operandi
Malware Acquisition
Akande purchased licenses for the Warzone remote‑access trojan (RAT) and a crypter to evade antivirus detection. The Warzone infrastructure was later seized by the FBI in February 2024.
- Warzone RAT details: BleepingComputer tag
- FBI seizure report: BleepingComputer article
Phishing Campaign
He sent phishing emails impersonating the CEO of a Massachusetts architectural‑engineering firm to four tax‑preparation companies. The emails:
- Used a spoofed domain and email address matching the CEO’s name.
- Attached the executive’s 2019 tax documents (W‑2, 1099) for credibility.
- Included a Dropbox link purportedly containing prior‑year tax information.
When recipients clicked the link, a disguised executable was downloaded, silently installing the Warzone RAT on their networks.
“In reality, the Dropbox account contained a disguised executable file that, when downloaded and executed, would cause the Victim CPA Firms to unknowingly download RAT malware onto their computer networks,” the indictment states.
Data Theft and Fraud
Once inside the networks, Akande used the RAT to harvest:
- Social Security numbers
- Prior‑year tax data
He then filed fraudulent returns using the stolen information, seeking over $8.1 million in refunds. The funds were routed to bank accounts controlled by U.S. co‑conspirators, who withdrew cash and transferred portions to associates in Mexico under Akande’s direction.
Sentencing
U.S. District Court Judge Indira Talwani in Boston sentenced Akande to:
- Eight years in prison
- Three years of supervised release
- Nearly $1.4 million in restitution