Malicious emails with link to infected word documents

Hi there,

i just try to find out how this is possible without finding any virus on any device.

Lately we or our customers are getting emails that look like they are sent from the customer to us or from us to them.

The interesting thing is. The two persons are ALWAYS connected. They know each other. But the email address is wrong,

It looks for me that the GAL or maybe XING was compromised.

Some user trust the email sender name (not email address) and open the word document. Symantec caught some of them (but not all).

Anyone else experiencing this? 

Best regards

Stephan