I just got this email. It has a download link to a .jar file. I assume it just scans my computer for wallets and sucks them dry. Also, xapo.org is a dead domain. It's an obvious scam, but just posting it here in case it helps someone else.
Images were hidden due to low ratings.
Props for the heads up