Spain’s latest phishing scam: Endesa customers targeted

Spain’s energy customers are being hit by another wave of online scams — this time, a sophisticated phishing campaign impersonating Endesa, one of the country’s biggest electricity suppliers. The warning, issued by the Spanish National Cybersecurity Institute (INCIBE), highlights how fraudsters are using the company’s trusted name to spread malware and steal personal information.

Endesa, part of the international Enel Group, provides power to millions of homes and businesses across Spain. That reach makes it an irresistible target for cybercriminals who exploit public trust in well-known brands.

Fake Endesa invoices used as bait

The scam begins with a convincing email claiming that a customer’s latest electricity bill is ready for download. The message looks legitimate — complete with Endesa’s branding, logo, and tone of voice. However, the attached file is not a bill at all.

Victims who open the attached .zip file unwittingly unleash a malicious .msi file that installs malware onto their device. Once active, the program can intercept passwords, financial data, and even access stored files or online banking sessions.

Typical subject lines include alarming phrases such as:

• “Factura atrasada” (Overdue invoice)

• “Bloqueo inminente: regularice su factura ahora” (Account will soon be blocked – pay now)

• “Alerta de morosidad” (Late payment notice)

The intent is clear — to panic recipients into acting before they think.

What to do if you’ve received one

If you’ve downloaded but not opened the suspicious file, delete it immediately from your computer and empty your recycle bin.

If you did open the file, run a full antivirus scan with updated protection. Should the malware persist, INCIBE recommends resetting or formatting the device entirely and restoring only verified backup files.

Victims should also report the scam to the Spanish National Police or Guardia Civil, attaching any relevant evidence such as email headers or screenshots.

How to stay safe from phishing scams

Cybersecurity experts say vigilance is key. Always double-check the sender’s address and never click on links or attachments from unexpected emails — even if they appear official. Instead, visit the company’s verified website, such as www.endesa.com.

Source: Facua