Kaspersky Lab warns of phishing emails posing as government agencies
In short
Kaspersky Lab has warned of a new wave of fraudulent emails sent to corporate addresses that pose as government agencies and use QR codes leading to fake payment pages, according to RIA Novosti, CNews and iXBT. CNews and iXBT reported that Kaspersky solutions blocked more than 800 such messages since 11 September 2026. The company advised recipients to check sender addresses and not to follow QR codes in unexpected emails.
Why it matters
The mailings target employees' corporate inboxes, where a message imitating a familiar agency can lead a recipient to make a small payment and to enter bank card data. Kaspersky's blocked-message count since mid-September indicates the campaign is ongoing rather than a one-off. The documents give no information on whether anyone paid or lost money, so the practical damage is not established.
Key facts
- Kaspersky Lab reported a new wave of fraudulent emails sent to corporate addresses in which senders pose as government agencies. [ 1 , 2 , 3 ]
- The messages contain QR codes that lead to fake pages imitating a postal tracking service. [ 2 , 3 ]
- Kaspersky solutions blocked more than 800 such messages since 11 September 2026, the company said. [ 2 , 3 ]
- The emails mention an alleged upcoming inspection or say documents were sent by special delivery, and ask the recipient to scan a QR code to receive them. [ 2 , 3 ]
- Recipients are asked to pay a small sum for alleged postal services and then to enter bank card details on a fake payment page. [ 2 , 3 ]
- According to iXBT, the fake payment page requests the card number, expiry date, CVC code, cardholder name and phone number. [ 3 ]
- Kaspersky specialists advised checking the sender's address and not entering card data on a page opened from a QR code in an unexpected email. [ 3 ]
Confirmed by several sources
- Kaspersky Lab warned about a new wave of fraudulent mailings. [ 1 , 2 , 3 ]
- The fraudulent emails are sent to corporate addresses and their senders pose as government agencies. [ 2 , 3 ]
- The messages contain QR codes leading to fake pages. [ 2 , 3 ]
- Kaspersky solutions blocked more than 800 such messages since 11 September 2026. [ 2 , 3 ]
- The scheme asks the recipient to make a small payment and then to enter bank card details. [ 2 , 3 ]
Still unclear
- Whether any recipients made the payment or lost money, and how many companies received the messages. None of the documents state whether the scheme succeeded or give a figure for affected companies or employees.
- Kaspersky had already observed similar mailings in spring, before the current wave. This is stated only in the CNews report; the other documents mention only the current wave.
What local media are saying
Timeline, local time
- RIA Novosti publishes its report on the Kaspersky Lab warning about a new wave of fraudulent mailings. [ 1 ]
- CNews publishes details of the scheme, including more than 800 messages blocked since 11 September 2026. [ 2 ]
- iXBT reports the same campaign and adds advice on verifying sender addresses and not entering card data. [ 3 ]