Nothing in the attack chain screams malicious software, except none of the impersonated HR and payroll providers actually offers a desktop app ...