During the pre-holiday period, attackers are sending invoices to companies for the delivery of non-existent documents.