Fake invoices are the #1 disguise for distributing malware.
Symantec 2018 ISTR
Spam and phishing emails come packaged up in all sorts of disguises. According to Symantec’s 2018 Internet Security Threat Report, these are the most common when it comes to distributing malware.
Most common disguises:
Bill / invoice (15.9%)
Email delivery failure (15.3%)
Legal / law enforcement (13.2%)
Scanned document (11.5%)
Package delivery (3.9%)
