Israeli Cyber Unit Warns Against Suspicious Invoice Emails Containing Remote Access Malware

The Israeli National Cyber Directorate has issued a warning about a wave of suspicious emails impersonating legitimate invoice services. These emails contain links to download a remote access tool called ScreenConnect, which is typically used for legitimate purposes but in this case is part of a malicious attack allowing hackers to take control of victims' computers.

One common variant of these phishing emails pretends to be from the cybersecurity company ESET, with subject lines such as "Tax Invoice Receipt Number 70202" and sender names like "ESET Antivirus Store." The Cyber Directorate strongly advises recipients not to click on any links, download files, or approve remote access software installations from unexpected emails.

Users are urged to carefully verify invoice-related emails, especially those received without clear context, and to keep their operating systems and security software up to date. This is not the first time attackers have impersonated ESET; similar phishing attempts were reported in June 2025 involving fake antivirus license emails leading to malware downloads.

The Cyber Directorate also recommends maintaining current backups of important files and avoiding installation of remote access tools unless absolutely certain of their legitimacy. The ongoing alert highlights the importance of vigilance against phishing campaigns exploiting trusted brands to spread malware.