---
title: "Kaspersky Flags SilverFox Phishing Attacks in South Africa"
description: "Kaspersky says the SilverFox group is targeting South African firms with tax-themed phishing emails that deliver malware via fake audit notices and archives."
canonical_url: "https://liners.com/news/kaspersky-silverfox-phishing-attacks-south-africa"
markdown_url: "https://liners.com/news/kaspersky-silverfox-phishing-attacks-south-africa.md"
type: "article"
language: "en"
published_at: "2026-04-30T10:01:03.137Z"
updated_at: "2026-04-30T10:01:03.158Z"
---

# Kaspersky Flags SilverFox Phishing Attacks in South Africa

Kaspersky says the SilverFox group is targeting South African firms with tax-themed phishing emails that deliver malware via fake audit notices and archives.

## Breadcrumbs

- [News](/news)
- [Kaspersky Flags SilverFox Phishing Attacks in South Africa](/news/kaspersky-silverfox-phishing-attacks-south-africa)

## Content

## In Short
Kaspersky has identified new waves of SilverFox cyberattacks targeting companies in South Africa. The group uses tax themed phishing emails to trick staff into opening malicious files.

## What Happened
Kaspersky says its Global Research and Analysis Team tracked several new SilverFox campaign waves observed since December 2025.

The messages are phishing emails, meaning they try to impersonate a trusted organisation to make someone click. In this case, emails are crafted to look like official tax audit notifications.

Other emails prompt recipients to download an archive file that supposedly contains a “list of tax violations.” An archive is a compressed folder, like a zip file, used to bundle documents.

The goal is to get a target to open or run the contents, which can lead to malware, malicious software that can steal data or give attackers remote access.

## Why It Matters
Tax and compliance language is a strong lure for finance teams, executives, and administrators. It also adds urgency, which can reduce careful checks before opening attachments.

For South African businesses, the impact is not only device infection. Phishing can lead to credential theft, meaning attackers capture login details for email, payroll, ERP, banking portals, and cloud dashboards.

Teams should treat tax audit emails as high risk until verified. Useful steps include checking the sender domain, avoiding opening unexpected archives, and confirming requests via a separate channel, like calling an official number.

## Source Attribution
ITnewsafrica (April 30, 2026)

## Sources and products

- [ITnewsafrica](https://www.itnewsafrica.com/2026/04/kaspersky-identified-a-new-silverfox-campaign-targeting-companies-in-sa/)

## Related pages

- [Market Trends](/news)

## Access and citation

- [Canonical HTML page](https://liners.com/news/kaspersky-silverfox-phishing-attacks-south-africa)
- [Markdown route index](/sitemap.md)
- [Agent access guide](/llms.txt)