The malware appears to come from several phishing campaigns, according to the FBI and Department of Homeland Security.