A piece of malware identified by MX Lab as Gen:Variant.Strictor.49180 (Upatre) is being distributed with the aid of at least two different spam runs.
The first one relies on fake ADP invoice emails that purport to come from payroll.invoices@adp.com. The bogus notifications read something like this: