No matter how much they know or think they know about protecting themselves from phishmail and the malware links they hold.
The extraordinary leap in the number of fake anti-virus messages this year is now taking new and both more personal more official-looking twists, either of which can catch users off-guard.
Let your people know that a) "Microsoft Windows Agent" messages about infections and cleanups should be deleted immediately (and, preferably, blocked before they reach their targets) and ) no cleanup tools or anti-virusware should ever be installed with approval of your systems administrator.
Speaking of systems administrators, another of the variants making the rounds appears to be a message from your admin, using the recipient's own domain, letting them know that their e-mail account is being upgraded for security and other reasons, and that their participation is required in the form of clicking an included link.
The link, needless to say, launches an infection, in this case the ZeuS Trojan/Zbot banking information thief.
Time to remind everyone of the evolving nature of phishing campaigns, and to put together a memo that clearly identifies what sorts of messages your legitimate systems administrators will use when contacting employees -- and, crucially, what sorts of messages you won't use.
Unfortunately, considering the speed of threat evolution and the variety of new approaches and techniques the phishers are using, the second half of that memo will almost undoubtedly have to be updated constantly.