Spanish inboxes hit by fake police emails demanding €5,670 to halt 'operation endgame'
A fresh wave of spear-phishing that impersonates Spain’s National Police and Europol is persuading executives to wire €5,670 within hours to stop a non-existent cyber-crime investigation tied to the real Operation Endgame.
The lure: a four-page pdf from ‘andalusia’s regional government’
Criminals start the hustle with a spoofed sender that mimics the Junta de Andalucía, a detail that bypasses many secure-email gateways because the visible domain looks legitimate. Inside the attachment they drop every acronym that scares C-suites: Magnet Axiom, Pikabot botnet, Europol, even a forged letterhead of Spain’s Audiencia Nacional. The goal is simple: make the target believe their laptops have already been flagged in a cross-border police sweep.
Once panic sets in, a second message—this time from a plain Gmail address signed “Ministry of Justice”—offers a fast-track way out: pay for a “technical-legal audit” before special-forces teams kick down the door. A French IBAN, held by a Paris resident, is provided for the transfer. Researchers at Eset who dissected the chain say the mule is either a gig-economy courier convinced he is processing client refunds or a straw man whose ID was stolen to open the account.
Why this campaign lands harder than yesterday’s nigerian prince
The gang spent time. They mirror official case-number formats, reference indictments filed in The Hague and copy-paste paragraphs from real Europol press releases. The price tag—€5,670—is low enough to feel like a nuisance fee, yet high enough to finance the next round of malware builds. Companies that hesitate receive follow-ups warning that GEO operatives (Spain’s SWAT-style unit) have already been assigned.
Spanish law-enforcement sources confirm to TechCurrent that no judicial communication requests payment via email, let alone to a private individual in France. Yet the psychological trigger works: at least eleven mid-sized firms in the Basque Country and Catalonia have reported the approach since mid-April, and two transfers—one for the exact demanded amount—were halted only when a bank compliance officer flagged the beneficiary name.
Lo que nadie cuenta es que el documento lleva una firma digital caducada que, paradójicamente, valida que el PDF fue generado hace tres años en otro continente. Ese dato, que los estafadores olvidaron borrar, es la mejor prueba de que detrás hay una misma red que ya probó la misma plantilla en portugués e italiano.
Bottom line: call the real police, not the inbox police
If an email mentions Europol, Pikabot and a looming arrest, forward it to Spain’s National Police dedicated phishing address ([email protected]) and then delete it. Any demand for money to stop an investigation is, by definition, the investigation itself.