Phish of the Week 19th of October

# Phish of the Week

# Phishing

Internal Layoffs Notice

Mette Luntama

Phish of the Week: Internal Layoffs Notice HR Impersonation with Microsoft Credential Harvester

This campaign impersonates a company’s own HR department with an email announcing layoffs, personalized with the recipient company’s name to look like an internal message. The email claims an attached letter lists the employees who will lose their jobs, which pushes recipients to open it quickly before they stop to question the sender.

How the attack works:

The recipient receives an email from “HR Department” with the subject line “[Recipient company] Internal Layoffs Notice.” The signature block repeats the company name and adds a payroll email address, phone numbers, and a website that all use the recipient company’s details.

The message explains that the company must cut staff because of inflation, declining cash flow, and rising operational costs. It says the attached letter contains the names of the affected employees and that anyone on the list will be invited to a meeting about the next steps.

Behind the “Layoff_Letter.pdf” sits a Google short link that redirects the recipient to malicious content.

The link opens a fake document portal hosted on a look-alike domain. The page shows the recipient company’s name, a Microsoft logo, and the same “Layoff_Letter.pdf” file with a “Download Document” button, so the story from the email continues without a break.

Clicking the download button leads to a credential harvester that mimics the Microsoft sign-in page. The recipient’s email address is already filled in, and the page only asks for a password. Any password entered goes straight to the attacker.

Why the attack works:

A layoff notice is one of the few emails almost nobody can ignore. The only way to find out whether your own name is on the list is to open the letter, so the email creates a strong need to act right away. Worry about one’s job also leaves little room for checking sender details or links.

The lure is also easy to reuse at scale. The economic reasons given are vague enough to fit any organization, and inserting the recipient company’s name into the subject, signature, and portal makes a generic template feel like a real internal announcement. The prefilled email address on the sign-in page adds a final touch of familiarity right at the moment the password is requested.

How to spot similar attacks:

Sensitive news such as layoffs arrives by mass email with a generic greeting like “Dear Team” instead of through managers or official internal channels.

The sender is a generic “HR Department” label, and the actual sender address does not belong to the company’s own domain.

Hovering over the "attachment " shows a link, often a URL shortener, instead of a real file.

Opening a document leads to a page on an unfamiliar domain that asks for Microsoft credentials.

The sign-in page has your email address already filled in, even though you arrived there from a link in an email.

If an email announces layoffs or other HR changes, open your company’s intranet or HR system directly, and only sign in to Microsoft through an address you type yourself.

What is Phish of the Week?

Phish of the Week is a weekly content initiative by Hoxhunt’s Threat Operations team. Each week, we highlight a current phishing trend or notable real-world attack, covering what the threat is, how it works, and what to watch for to spot similar attacks in the future. The goal is to build consistent recognition of evolving phishing themes and tactics over time.

Comments (0)

Popular