Cyber criminals are currently using phishing to spread a malware called Strela Stealer via German-language emails. Strela Stealer harvests login data from Outlook and Thunderbird accounts. The criminals then use originally legitimate emails containing invoices, which they forward and send to their victims. These victims then receive what appear at first glance to be identical emails, with only the recipient address and the attachment having been changed. Instead of the invoice, the criminals send .zip files with the same name that contain malware. Our data based on the meta information collected in 32Guards shows the approach of the spammers as well as the distinctive features of phishing emails – and how you can protect your email address from misuse.