The Tax Authority of Ukraine has uncovered fraudsters sending emails with malicious software.

According to the agency, these emails have the subject line «Document Request from the State Tax Service of Ukraine: *ORGANIZATION NAME*» and include a PDF attachment.

They contain a link to a service hosting a JS script named «Request from the State Tax Service of Ukraine SED 22.05.2025- 0048811.pdf.js». Clicking this link results in the downloading and execution of software for remote control of users' computers.

It is important to note that official correspondence from the Tax Authority always includes the domain name «tax.gov.ua» after the «@» symbol.

"Cybersecurity specialists from the Tax Authority, along with the Government Computer Emergency Response Team of Ukraine CERT-UA, discovered instances of fake emails supposedly from the Tax Authority," the agency stated.