The Toll Clerk Who Paused Your Fine as a Favour

A spearphishing campaign impersonated Swiss (and Austrian) toll authorities, offering to retroactively clear a 200 CHF fine for a 40 CHF “goodwill” payment; the messages were sent via a self-hosted Listmonk server, passed SPF and gateway scanners, reached Microsoft 365 inboxes at SCL -1, contained a benign-looking link, and were identified as malicious only after a user report and human analysis. The report lists specific indicators (sending IP 107.189.7.143, display names, subject, fabricated dossier number CH-2026-X94B, and X-Listmonk-Campaign header), maps the attack to MITRE T1566.002 and T1204.001, and recommends training and contextual detection to catch friendly-sounding pretexts.