Fake business invoices are being sent, claiming they are generated by a legitimate company, CTP Accounting Romania—I have just investigated one recently received email, so you don’t have to. If you receive a similar invoice, please double-check its legitimacy and carefully verify the IBAN code.
The email pretends to be:
- CTP Accounting Romania (real company branding)
- Sending an invoice attachment (likely infected with malware)
- With a large payment request: 33,850.58 RON
- Under urgency (due date: 19.06.2026)
Attachment:
FVP2698110266_CTPark Bucharest_2698110286.xls
This is the real payload: an Excel file likely containing malware, macro payload, or credential-stealing link
Actual sender:
[email protected]
IP: 188.132.226.75
Host: mail.sev-tek.com (Turkey-based hosting)
What the FVP2698110266_CTPark Bucharest_2698110286.xls file likely contains:
- VBA macros – potentially malicious code that executes when enabled
- Excel formula injection
Ensure you have an up-to-date antivirus solution, as it should detect and block such downloads.
What do do?
- Do not open the attached file
- Report to the IT/Security department immediately with:
Sender email address
Email headers: How to get them? https://mxtoolbox.com/public/content/emailheaders/ - Report to your email provider as phishing
CTPARK BUCHAREST SRL
Sat Dragomiresti-Deal, Comuna Dragomiresti-Vale, , Str. Gabriela, nr.1, Cladirea B, Parter, Judet Ilfov
Comuna Dragomiresti-ValeRomania
Ilfov, RONR. Reg. Com:
Cod Fiscal: RO16532357
Cont IBAN: 5121468-RO08BACX4002Stimate Partener,
Va trimit atasat prezentului e-mail factura originala
Client:
Factura Nr: 2698110286
Data scadenta: 19.06.2026
Suma datorata: 33.850,58 RON
Detalii factura : Va facturam conform prevederilor Contractului de inchiriere semnatMultumim,
Acest e-mail este generat automat de Microsoft Dynamisc AXCreat de: Automaticinvoicing
Telefon:
E-mail: [email protected]