Fake 401K year-end statements used to steal corporate credentials

Cofense reports a rise in targeted phishing campaigns that impersonate HR-related communications (401(k) notices, open enrollment, pay raises, and performance reports) to steal employee credentials; attackers increasingly embed QR codes linking to fraudulent login pages, and defenders are advised to schedule legitimate HR communications, educate staff, and avoid using QR codes in sensitive corporate messages.