Fake Tax Authority Emails Deploy Crypto Drainers – How to Detect and Block

What happened

Scammers have begun sending emails that appear to originate from European tax authorities. The messages contain links or attachments that, when opened, download and install crypto‑draining malware onto the victim’s machine.

Who is affected

The campaign targets anyone who receives a tax‑related email, including private individuals, small businesses, and larger organizations that handle payroll or tax filings. The attackers rely on the trust that recipients place in official government correspondence.

Impact

Once the malware is installed, it silently monitors the victim’s system, searches for cryptocurrency wallets, and transfers any found funds to the attacker’s addresses. The loss is typically irreversible and can amount to thousands of euros per victim.

What to do

Defenders should treat any unsolicited tax‑related email with suspicion. Verify the sender’s domain against official government domains, and do not click links or open attachments unless the email is confirmed legitimate.

Detection and Mitigation

• Enable SPF, DKIM, and DMARC to reduce spoofed emails.
• Deploy advanced email filtering that flags known malicious URLs and attachment hashes.
• Educate staff on the specific phishing indicators used in this campaign.
• Monitor endpoints for the presence of known drainer binaries and for abnormal outbound connections to cryptocurrency exchanges.
• Use a threat‑intel feed that includes the latest malware hashes and command‑and‑control domains associated with the drainer.