From [CivicaReports@plymouth.gov.uk]There are at least four different version of the document in circulation, each containing a malicious macro. Download locations spotted so far are:
Date Thu, 08 Oct 2015 14:03:31 +0400
Subject Invoice for Payment
THIS IS A POST-ONLY EMAIL. PLEASE DO NOT REPLY TO THIS MESSAGE. THIS
IS NOT MONITORED FOR RESPONSES.
From: Plymouth LIVE SYSTEM (New)
Please find attached your invoice for payment in accordance with our
agreed terms and conditions.
The invoice is sent in PDF format. Double click on the attachment to
open the file.
PDF files require Adobe Acrobat Reader to view them. Download Adobe
free of charge from the Adobe website at www.adobe.com/products/reader
For enquiries specifically relating to this invoice, please e-mail :
This e-mail is confidential and intended for the exclusive use of the
Any views or opinions expressed in this e-mail do not necessarily
represent those of Plymouth City Council, and are not to be relied upon
without subsequent written confirmation by an authorised representative.
If you are not the addressee, any disclosure, reproduction,
distribution, forwarding, or other dissemination or use is strictly
prohibited. If you have received this e-mail in error please notify the
Plymouth City Council Transaction Centre (incomes) helpdesk on 01752
Plymouth City Council, The Civic Centre, Armada Way, Plymouth, PL1 2AA.
Telephone : 01752 668000 Website : www.plymouth.gov.uk
The payload is exactly the same as used in this spam run.