It started with the discovery of the Osx.Dok Trojan on Friday, 4/28/2017:
The main delivery mechanism for this malware is by Email attachment. Check suspicious Emails by viewing the message headers. If you see any of the following messages on your display, you’ve got a Trojan at your doorstep. Note that in the case of the Apple Update, Apple calls it’s O/S “macOS”, not OS X. Don’t click any further. Power off the Mac, turn in back on, and then do an antivirus scan.