I only stumbled on this at the middle so I don’t know how this is being targeted to users. Apparently this particular scam has been out there since at least August 2013 and it’s still up and running.
This is a VBScript Encoded file (VBE) that starts off the fraud
read more.....http://www.kahusecurity.com/2014/vbe-script-leads-to-bank-fraud/