Israeli Cyber Unit Warns Against Suspicious Invoice Emails Containing Remote Access Tools

The Israeli National Cyber Directorate has issued a warning about phishing emails disguised as invoices sent through a known invoicing service. These emails contain links that download ScreenConnect, a remote access tool which, while legitimate in many contexts, is being exploited here to enable attackers to take control of victims' computers. One common variant impersonates the cybersecurity company ESET, with subject lines like "Tax Invoice Receipt Number 70202" and appears to come from "ESET Antivirus Store."

The Cyber Directorate advises recipients not to click on any links, download files, or approve remote access software installations from unexpected emails. They recommend carefully verifying invoice-related emails, especially those received without clear context, and keeping operating systems and security software up to date. This is not the first time ESET has been impersonated; similar phishing attempts were reported in June 2025 involving fake antivirus license emails leading to malware downloads.

Additionally, the Cyber Directorate stresses the importance of maintaining updated backups of important files and avoiding authorization of remote access software installations from suspicious sources. The warning aims to prevent users from falling victim to this malicious attack vector that could compromise their devices and data.