Circor emails with an attached word document containing a macro. These emails aren’t from these companies at all, they are just being used to make the email look more genuine, ie. from a real company. It’s also worth remembering that the company itself may not have any knowledge of this email and it’s link(s) or attachment as it won’t have come from their servers and IT systems but from an external bot net. Apple and Android software can open these attachments and may even manage to run the macro embedded inside the attachment.”]
Source: http://sanesecurity.blogspot.com/2015/03/cit-inv-15013919-for-po-sp1438-circor.html