Email from 'Citibank' conceals Trojan