Spain Hit by Cyber Fraud Wave: Phishing Attacks Flood Email Inboxes

Photo: Elcaso

Spain’s Catalonia region is facing a surge in phishing campaigns targeting email users with fake messages posing as major telecom and energy companies, Elcaso reports. These emails appear authentic, often resembling real notifications about unpaid bills, service interruptions, or suspicious transactions. However, clicking links or opening attachments infects devices with malware designed to steal personal and financial information.

The Technology Behind the Scam

Fraudsters send near-perfect replicas of messages from Movistar, Vodafone, and Iberdrola, complete with corporate logos and formatting. The fake notifications claim users owe money, threaten service suspension, or demand urgent payment. This strategy relies on emotional manipulation — creating panic to provoke a quick, unverified reaction.

Clicking the link doesn’t lead to the company’s website but instead downloads an .ISO file, disguised as an invoice or informational document. In reality, it contains malware that harvests passwords, banking data, and identity documents, and grants criminals access to email and social media accounts. Victims often realize they’ve been compromised days later — after noticing strange transactions or unauthorized logins.

Experts also warn about aggressive scams involving fake Iberdrola bills exceeding €10,000, which create immediate panic and lead victims to open attachments “to check.” The deception is so sophisticated that even experienced users are being fooled. The scale of attacks continues to grow as criminals rapidly update their malware tools and phishing techniques.

Spain’s Cyber Threat Landscape

According to the SOCRadar “Spain Threat Landscape Report 2025” source, Spain ranks among the most targeted digital environments in Europe. Sectors managing large volumes of client data — such as retail, finance, and e-commerce — account for over a third of all incidents. Manufacturing remains a top ransomware target, with nearly 18% of ransomware cases hitting industrial enterprises. The RansomHub group is currently the most active, posing major risks to operational continuity.

Phishing remains the primary attack vector: nearly half of phishing emails target banks, followed by financial services and telecoms — mirroring the current wave of fake Movistar, Vodafone, and Iberdrola messages. The report also highlights a sharp rise in data leaks: dark web marketplaces are seeing more listings for patient records, government credentials, and user databases from major apps. More than 74,000 DDoS attacks were recorded in 2025, with some peaking at nearly 500 Gbps, threatening both corporations and critical national infrastructure.

European Trends

Across Europe, the volume of multi-stage cyberattacks is rising, according to ENISA’s “Threat Landscape 2025” report [leech=https://www.enisa.europa.eu/sites/default/files/2025-10/ENISA%20Threat%20Landscape%202025.pdf]source[/leech
]. From July 2024 to June 2025, analysts reviewed nearly 5,000 incidents, concluding that social engineering remains the most common entry point into corporate systems.

About 60% of successful attacks begin with phishing, “vishing” calls, or malicious emails, while vulnerability exploitation accounts for just over 20%. Industrial networks are particularly exposed: disruptions in these systems can halt supply chains and critical production processes.

ENISA also notes a major shift in attack behavior — from isolated strikes to long-running parallel campaigns using similar tactics. The boundaries between cybercrime, hacktivism, and state operations are blurring, making threats harder to predict. Artificial intelligence now plays a significant role: by mid-2025, over 80% of phishing emails were generated using AI, increasing realism and reducing detection rates. In short, low-quality phishing attempts are decreasing, but the threat level is rising sharply.

How to Protect Yourself

Cybersecurity experts advise treating all urgent or emotional emails with caution — especially those demanding payment, transaction verification, or warning of imminent service suspension. These are classic social-engineering tactics exploiting fear and urgency. Always check the sender’s email address, and never click embedded links. Instead, visit the official company website or mobile app directly.

Good cyber hygiene also helps. Keep systems updated, use reliable antivirus software, and avoid opening suspicious attachments. Legitimate companies never send .ISO files to customers — such attachments are a clear red flag. Malicious documents often appear as invoices or payment requests, so avoid downloading anything unexpected.

If you’ve already opened a file, immediately disconnect from the internet, run a full antivirus scan, and, if necessary, contact a cybersecurity specialist. Victims in Catalonia are encouraged to report incidents to the Mossos d’Esquadra police unit. These reports help trace evolving fraud patterns and support the investigation of cybercrime across the region.