Fraudsters send emails to corporate addresses of Polish companies claiming to be Spirotech.
The content of the message prompts you to click on the image that imitates the typical attachment from Gmail. The message is sent from Jarosław Kowalczyk, an “employee” of Spirotech. However, the domain from which the message has been sent is angst-pflstar.com, at this time this should trigger a red flag.

The content of the message is as follows:
Please note the following inquiry received from the owners. We kindly ask you for a refund with a quote with 5% commission for our office and 30 days credit as payment terms. Your quote should include shipping costs, customs or other fees and a total cost estimate. Please also send the company's consent to the above-mentioned service. Your prompt reply will be highly appreciated.

According to the Niebezpiecznik, click on the “attachment” will download an .iso file to the device, infecting the system with malware.