"We’re releasing the list of personnel evaluations and promotions for the second half of FY2026 in advance" — a story about receiving a sneaky phishing email

A phishing email impersonated an HR/payroll notice about a secret preview of 2026 second-half evaluations and promotion candidates.

The message urged recipients to open an “authenticated document” link, likely leading to a fake login page.

The goal appears to be stealing employee credentials, including VPN or account access.

The case highlights how attackers exploit realistic workplace topics to make malicious emails look trustworthy.