A routine electronic invoice can look harmless on its face, which is exactly why criminal groups keep turning trusted business paperwork into a malware delivery channel.