Fraudsters send fake e-mails en masse, masquerading as the State Tax Service of Ukraine. About this warn DPS cyber security specialists.
The fake letters are sent with the subject “Request for documents of the GU DPS of Ukraine” and contain the name of the real organization to which they are allegedly addressing. The attachment contains a PDF file that aims to mislead users into opening dangerous content.
In the attached file, a link to a JavaScript file called “Request of the State Security Service of Ukraine SED 22.05.2025-0048811.pdf.js” was found. Clicking on this link automatically downloads and runs software to remotely control the victim’s computer.
The main goal of attackers is to gain full access to the user’s personal device through remote control programs. This makes it possible to steal sensitive information: passwords, bank details, personal files, etc. The State Tax Service emphasizes that real email addresses of its structures must contain the domain “@tax.gov.ua”. Messages sent from other domains should be considered suspicious.
We will remind you that in September, the DPS already recorded similar fraudulent attacks, when criminals changed the addresses of the senders to imitate the official mailboxes of territorial tax authorities. The letters demanded contact via third-party messengers, including Telegram or WhatsApp, using phone numbers that did not belong to tax officials.
