{"success":true,"data":{"id":"kronofogden-brand-phish","label":"Fake Kronofogden (Swedish Enforcement Authority) brand spoof — threat language + off-domain link.","description":"Fake Kronofogden (Swedish Enforcement Authority) brand-spoof phishing. Kronofogden handles betalningsföreläggande (payment orders) and utmätning (wage garnishment). Attackers send fake enforcement notices threatening löneutmätning or legal action within hours, linking to off-brand payment portals. Fires when: Kronofogden brand/vocabulary + threat/enforcement language + all hrefs off kronofogden.se + no List-Unsubscribe + no In-Reply-To. Source: GE-R8; Polisen phishing alert 2025.","tier":"danger","category":"phishing","isThin":false}}