Threat Actors Taking Advantage of Open Enrollment, 401K Updates, and other Timely HR Initiatives

This report highlights phishing campaigns that exploit end-of-year HR touchpoints—open enrollment, 401k statements, employee assessments, and salary adjustments—to harvest credentials, increasingly leveraging QR codes, ZIP-embedded HTML pages, and realistic HR spoofing. It emphasizes the effectiveness of timing and emotional triggers in social engineering and underscores the need for consistent organizational communication schedules and user education to mitigate these credential-phishing threats.