Spanish police impostors demand €5,670 to 'cancel' fake pikabot probe
The email lands with the cold authority of a National Court subpoena: your company is under investigation for aiding the Pikabot botnet, Europol’s Operation Endgame has you on the list, and a Magnet Axiom forensic scan proves it. The price to make the file disappear? Exactly €5,670. It is a lie, but the staging is so meticulous that even seasoned IT staff in Andalucía have already asked their lawyers if the threat is real.
How the con dresses up as justice
Researchers at ESET have tracked the same script for weeks: a spoofed sender that masquerades as the Junta de Andalucía, a four-page PDF stuffed with authentic police jargon, and a reply-to address that claims to belong to Spain’s Audiencia Nacional. The attachment references real operations, real cyber-crime units, and a real piece of malware—Pikabot—to push the victim into panic. Once the fear sets in, the path is simple: contact the supplied Gmail account, receive a second message supposedly from the Ministerio de Justicia, and choose between prosecution or an urgent “technical-legal audit” that, for the price of a second-hand car, will supposedly wipe the slate clean.
The money does not stay in Spain. The criminals route it to a Paris-based account whose holder is, in all likelihood, a mule recruited through fake job ads. The mule forwards the cash minus commission, or launders it through crypto wallets, leaving Spanish investigators chasing ghosts in the 15th arrondissement.
Why this campaign feels different
Older sextortion scams were blunt: sloppy grammar, Hotmail addresses, a blurry logo. This one replicates the margins, fonts and legal headers used by real Spanish courts. Timestamps match European business hours, footnotes cite actual Europol press releases, and the PDF metadata is scrubbed to erase Russian or Nigerian fingerprints. The effort is paying off: ESET’s telemetry shows a 280 % spike
The criminals have learned that institutional trust is easier to counterfeit than a bank’s. By the time the target notices the Gmail domain where a gob.es should sit, adrenaline has already clicked “download”.
The cheapest defence costs nothing
Forward the mail to [email protected] or your nearest Guardia Civil cyber unit, then delete it. No Spanish court issues fines by email, no law firm demands payment in PDFs, and no Europol investigator uses consumer Gmail. If doubt still scratches at the door, call 017—the free, 24-hour cyber-crime hotline—and read the headers aloud. The operator will laugh, and that single laugh is worth more than any invoice.