Hi All,
Just in case…
There are some domains receiving email with subject lines similar to “FW: Reference Number #30901588, Last Payment Notice”, “FW: Invoice #81012997 from DataCorp Inc.” etc.
These emails contain a zip file attachment and inside those zips are a javascript (js) file. Double-clicking the js file invokes an Avira antivirus download as well as a time-bomb trojan.
Please issue an alert to all your users that if they receive an unexpected email with a similar subject line they should not open it. If in doubt that an ‘expected’ invoice email is valid or not please feel free to send it across to us for a quick once-over.
Keep fighting the good fight 
M.