A Romanian-based criminal group is behind a new trojan-laced, socially engineered email run that tries to trick recipients into believing their employer committed payroll reporting fraud, security researchers said today.