Just as an FYI, another round of these must have just gone out last night.
Shared file name is the same - *2024 PAYROLL UPDATE.docx *- and the domain
it's coming from is  @kckps.org (Kansas City Kansas Public Schools). I've
already emailed their support.

On Mon, Mar 4, 2024 at 3:25 PM Trey Cates - Director of Technology <
[log in to unmask]> wrote:

> Same here. We had a user fall for it, but our business office was smart
> enough to report the message.
>
> Sincerely,
>
> Trey Cates
> Director of Technology
> [log in to unmask]
> Central Vermont Supervisory Union
> 111B Brush Hill Road
> Williamstown, VT 05679
>
> (802) 433-5818 ext. 1887
> (802) 433-7087 (My Direct Line)
> (802) 433-7095 (Technology Team Help Desk)
> (802) 433-5825 (Fax)
>
> BOOK AN APPOINTMENT ONLINE: CLICK HERE
> <https://calendar.app.google/GN3AGnTvSsvLW9uT8>
>
>
>
>
>
> On Fri, Mar 1, 2024 at 11:07 AM Raymond Ballou <
> [log in to unmask]> wrote:
>
>> Dear List
>>
>> We had an account compromised, the only thing to add so far is that the
>> bad actor emailed our business office to have the employee's direct
>> deposit changed (which we won't do based on an email of course) about an
>> hour BEFORE they started sending out emails.
>>
>> Thanks to all,
>>
>>
>> R
>>
>> -----------------------------------------------------------------------
>>
>> Search <http://list.uvm.edu/archives/school-it.html> the SCHOOL-IT
>> Archive
>>
>> Manage <http://list.uvm.edu/cgi-bin/wa?SUBED1=SCHOOL-IT&A=1> your
>> Subscription to SCHOOL-IT
>>
>
> *This email communication and any attachments may contain confidential and
> privileged information for the use of the designated recipients. If you
> have received this communication by mistake, please destroy and contact the
> sender.*
>
> -----------------------------------------------------------------------
>
> Search <http://list.uvm.edu/archives/school-it.html> the SCHOOL-IT Archive
>
> Manage <http://list.uvm.edu/cgi-bin/wa?SUBED1=SCHOOL-IT&A=1> your
> Subscription to SCHOOL-IT
>