Talking phish over turkey · Blog · Sublime Security

This blog-style threat intelligence note describes a series of year-end credential phishing campaigns that impersonate HR, benefits, and review communications (open enrollment, bonus notifications, annual certifications). It highlights common signals and TTPs—authoritative display names, brand impersonation, QR codes, suspicious attachments and document notifications, HTML attachments with obfuscated JavaScript that render fake login forms, and the abuse of legitimate services (e.g., DocuSign)—and encourages awareness and defensive behavior to reduce credential theft.