Researchers have observed an increase in malicious domains and campaigns impersonating tax agencies and financial institutions.