[key points]

Key points

• •ESET Spain has detected a new wave of fraudulent emails impersonating the Tax Agency to steal business credentials.
• •The emails use tax-related lures to trick companies and freelancers into opening malicious attachments.
• •The malware, once executed, deploys GuLoader (CloudEye) to download Snake/VIP Keylogger, which steals credentials from various services.
• •ESET warns that stolen credentials can lead to further attacks, such as data theft, ransomware, or extortion.
• •ESET recommends being cautious of unexpected tax notifications, verifying senders, training employees, and using updated security solutions.