Wide Fraud Waves: Trojan and Phishing Attacks in the Name of the WKO

Summary

Why is this warning issued?

This warning has been included because it is based on a report from Watchlist Internet. It is intended to protect other users from this scam. The assessed risk is elevated.

How the scam works

• The criminals send emails styled like the WKO with an official-sounding sender name (e.g., 'WKO-Service', 'WKO Abrechnung').
• The pretexts used are real topics such as the NIS-2 directive, the introduction of ID Austria, the mandatory e-invoice, the 2026 year-end information, or the supposedly necessary review of outdated company data.
• The victims are put under time pressure: deadlines (e.g., by 6 October), threatened consequences (e.g., invalidity of the company register or VAT ID number), or important notices regarding the turn of the year.
• Either an attachment is to be opened/filled out and sent back – hidden within is a trojan that loads malicious software onto the device.
• Or the victims click on a link or open an HTML document and land on a deceptively real WKO login page.
• On this fake page, WKO login details are to be entered, which go directly to the criminals – some links on the page, however, genuinely lead to the WKO in order to build trust.

How to recognise it

• Sender name sounds like the WKO, but the actual sender address uses the domain wko.com – the real WKO domain is wko.at.
• The signature lists the postal address Wollzeile 14-18 in Vienna – the WKO is not located there.
• Salutation is generic ('Dear Sir or Madam') instead of being addressed to a specific company.
• Self-designation 'Wirtschaftskammer Österreichs' with an 's' at the end – unusual, normally without the s.
• Documents or links appear hastily cobbled together (e.g., nonsensical date information such as closure times from 24 September 2026 to 1 January 2026).
• The attachment is an HTML document or an executable file that redirects to an external page – and not directly to the real WKO page (wko.at).
• Request to fill out a form in the attachment, send it back, or log in via a link – combined with threatening scenarios like deadlines or consequences for the VAT ID/company register number.
• Generic salutation and time pressure

How to protect yourself

• Check the real sender domain: The WKO uses wko.at – anything else (e.g., wko.com) is suspicious.
• Do not open attachments and do not click links in unsolicited emails that ask you to fill out forms or log in – especially not if deadlines or threats are involved.
• Do not log in via a link from an email; instead, open the WKO page manually in your browser and check there whether there is actually a notification.
• Preserve evidence: Save the email including header data and, where applicable, the storage location of the email (e.g., screenshot, export), before you delete it.
• If you have opened an attachment or entered data: Disconnect the device from the network, change your WKO password immediately, and have the device scanned for malware.
• Report the incident to the consumer protection centre and/or the police, and if applicable, inform the WKO via their official contact channels.

What you should never do

• Do not open attachments in emails sent in the name of the WKO – particularly not if you are asked to perform a function or send back data.
• Do not enter login details on a page reached via a link from an email – only enter WKO access details on the page you access yourself via your browser.
• Do not react to time pressure or threats (e.g., deadlines, consequences for the VAT ID number) by sending back unchecked forms or disclosing data.
• Do not simply pay or confirm if something is to be 'reviewed' or 'updated' – just because an email claims so, that does not make it true.
• Do not confirm instructions from the email by phone or by reply email without first cross-checking them against the official WKO page (wko.at).

Frequently asked questions

Affected data

Comments

Related warnings

• Betrug in zwei Akten: Die nächste Runde im Klimabonus-Phishing
• Pensionsleistung genehmigt: 723-Euro-Versprechen ist Phishing
• #10TageGegenPhishing: Niemals klicken! Immer selbst einloggen!
• #10TageGegenPhishing: KI-gestützte Betrugsversuche erkennen
• #10TageGegenPhishing: Quishing – Wenn QR-Codes zur Betrugsfalle werden
• #10TageGegenPhishing: Wie geht man mit verdächtigen E-Mail-Anhängen um?

Original source

Update history

• 09/10/2026Description updated
• 08/10/2026Warning added from an official source