A new wave of sophisticated phishing attacks is exploiting QR codes and convincing fake IRS websites to steal personal and financial information from vulnerable taxpayers.