Cybercriminals are attacking small online stores, trying to trick their employees into opening malicious files.