Fake ATO “Online Activity Statement”; Email Links to Malware
The original site is no longer online; links go to the Internet Archive copy.
The claim
Email purporting to be from the Australian Taxation Office (ATO) claims that you can click a link to download your next online activity statement.
What the fact-checkers found
The email is not from the ATO and it is not a legitimate activity statement notification. Clicking the link downloads a.zip file that harbours a malicious JavaScript file. If you open this JavaScript file, malware can be downloaded and installed on your computer.
According to this email, which claims to be an activity statement notification from the Australian Taxation Office, your next online activity statement is now available. It invites you to click a link to download your statement. The rest of the email contains generic information about lodging your BAS, lodgement due dates, and where to get further information.
However, the email is not from the ATO and it is not a genuine activity statement notification. Clicking the download link does not retrieve an activity statement as you might expect. Instead, it downloads a.zip file that contains a JavaScript (.js) file. If you click this file, a malicious JavaScript may then download and install malware on your computer.
The exact nature of the malware payload may vary. The JavaScript technique is often used to infect computers with ransomware, which, once installed, can encrypt all of the files on your computer and then demand that you pay a fee to online criminals to get a decryption key. Or, the JavaScript may download and install malware that can steal information such as online banking usernames and passwords.
Criminals have used similar ruses in the past to try to trick people into installing malware.
If you receive one of these emails, do not click any links or open any attachments that it contains.
Got a similar message?
Paste it into the detector and see whether it matches a known hoax.
Check a similar messageRelated fact-checks
Browse the archive →ATO “Right to Obtain a Refund”; Malware Emails
The emails are not from the ATO and the promised refund does not exist. It is a criminal ruse designed to trick you into visiting a fraudulent website and downloading malware.
Australian Tax Refund Scam Email
The email is a phishing scam. The message is not from the Australian Taxation Office. The promised refund does not exist. The scam email is designed to trick you into clicking a link and submitting your personal and financial information on a bogus website.
Paypal ‘You Sent a Payment’ Malware Emails
The emails are not from Paypal and the claim that a payment has been sent from the recipient’s account is a lie. Links in the emails open compromised websites that harbour information-stealing malware.
AGL “My Monthly Bill”; Malware Email
The email is not from AGL and the link does not open a power bill statement. It is a criminal ploy that tries to trick you into visiting a compromised website and downloading malware.