Spam campaigns using various email notifications purportedly coming from ADP lead to a blackhole exploit kit server. These spammed messages attempts to lure users into clicking a malicious link, which is also in the message body. Below are other spammed messages seen in this campaign:
While the victim waits for the website to load, the script is already pointing them to a blackhole exploit kit server, where an exploit code starts to execute. A .JAR file is executed, downloading other malicious files into the victim's machine.
Trend Micro™ Smart Protection Network™ protects users from this threat by blocking the spam mail samples, as well as any related malicious URLs and malware.