Forcepoint Security Labs registered activity Trickbot banking Trojan. The virus is spreading through the mailing. The letter imitates message from Canadian Imperial Bank of Commerce (CIBC) with the attached document. The victim becomes infected opening the attachment. Next TrickBot will show the authorization page when the user logs on. Such as PayPal and Coinbase.com.
Do not open attachments if you are not sure about the sender of the message.