E-mail today with a .doc attachment containing a macro.
“UK GEOLOGY PROJECT by “Rough & Tumble” with “Moussa Minerals”” <firstname.lastname@example.org>
Subject: Invoice as requested
Received: from srvintra.cer83.net (220.127.116.11)
Attachment SHA256 0f66b81ba27fa0e18b6545ef0574fc8d1978ff8e6ce27ec14e32951e8e1a4a2b
I’m not in a position to investigate what it does if you run it – I might update this post later if I do get time.