A virus notification message from our mail server was sent from a compromised server. Examining the mail on the server revealed some interesting details. The site had been hosting phish kits collections of malicious files which can be downloaded for free These are archives which just need to be extracted to a compromised host. All a cybercriminal needs to do is edit one of the files in that package and input a mail address where harvested information should be sent to. The twist is not only does the information get sent to the designated email address, but to another cybercriminal as well.”]
Source: https://securelist.com/all-your-phish-are-belong-to-me/30566/