The NY DMV alerted motorists that the scam
is just bait to entice them to click on a “payment” link that will in
turn infect their workstation with malware. The DMV does not know how
many people have been affected, but Owen McShane, director of
investigations at New York State DMV, said calls came in from New York
City, Albany and Syracuse.
Olenick was able to get a bit more detail:
"The malware being dropped came in two categories. The first simply
placed a tracking tool on the victim's computer to see what websites
were visited; and the second, more nefarious, attempted to acquire a
variety of personally identifiable information, such as names, Social
Security numbers, date of birth and credit card information."
There are several social engineering red flags (PDF)
that show the email is a scam. The text of the email posted supplied by
NY DMV shows the attack contains several punctuation errors, the
supplied links lead to sites without an ny.gov URL, tied to the fact that the state would never make such a request. Here is how the phishing email reads: 
“The Department of Motor Vehicles does not send emails urging motorists to pay traffic tickets within 48 hours or lose your license,” said Terri Egan, DMV deputy executive commissioner, in a statement.
McShane noted that this scam is similar to
one that hit the state about 18 months ago. The DMV, he said, is often
used as bait in phishing attacks. Most previous attacks only lasted for
24 to 48 hours and this attack seems to have wrapped up too at this
point, he added. This means that the bad guys may have moved on to other
states with this attack, so...
I suggest you send employees, friends and family an email about this Scam Of The Week, feel free to copy/paste/edit:
"Here is a reminder that you need to be alert for fake emails that look like they come from your local police or State Dept of Motor Vehicles (DMV) claiming you have a traffic violation. At the moment, there is a local scam in New York that falsely states you have outstanding violations you need to either pay for or refute, and if you don't your license will be revoked. This scam may spread to the rest of America soon. Remember that citations are never emailed with links in them, or sent out with an email attachment, and report scams like this to your local police department."
Obviously, an end-user who was trained to spot social engineering red flags like this would have thought before they clicked.
