{"id":1439,"date":"2026-04-22T14:15:43","date_gmt":"2026-04-22T21:15:43","guid":{"rendered":"https:\/\/blogs.pugetsound.edu\/infosec\/?p=1439"},"modified":"2026-04-22T14:15:43","modified_gmt":"2026-04-22T21:15:43","slug":"phishing-from-4-22-2026-employee-assessment-analysls","status":"publish","type":"post","link":"https:\/\/blogs.pugetsound.edu\/infosec\/the-phish-tank\/1439","title":{"rendered":"Phishing from 4\/22\/2026: “EMPLOYEE ASSESSMENT ANALYSlS”"},"content":{"rendered":"\n

Original Phishing Message<\/p>\n\n\n\n

From:<\/strong> Valentina Hernandez <ana[.]herediahernandez[@]austinisd[.]org>
Subject: <\/strong>EMPLOYEE ASSESSMENT ANALYSlS<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Where did the link lead?<\/p>\n\n\n\n

The link led to a form asking for your credentials. Never submit your credentials in an online form or on websites you do not recognize. Though Jotform is a legitimate site that allows individuals to create forms, the service can be maliciously used by attackers. <\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Tips for Detection<\/p>\n\n\n\n

    \n
  • Legitimate emails from Human Resources will generally come from an @pugetsound.edu email address. The sender’s email address is from an external domain. <\/li>\n\n\n\n
  • Does the sender work for the university? Are you expecting this email?<\/li>\n\n\n\n
  • Notice that the word “analysis” in the subject line is spelled “analysls” to likely avoid spam filter detection. Attackers commonly substitute lookalike characters or images to avoid text-based content filters. <\/li>\n<\/ul>\n\n\n\n

    Text of Phishing Message<\/p>\n\n\n\n

    From:<\/strong> Valentina Hernandez <ana[.]herediahernandez[@]austinisd[.]org>
    Subject: <\/strong>EMPLOYEE ASSESSMENT ANALYSlS<\/p>\n\n\n\n

    Dear Employee,
    We are pleased to announce that the Human Resources Department has finalized the performance assessment process for all employees. This is a significant milestone in our ongoing commitment to your professional development and growth within the organization.<\/p>\n\n\n\n

    Attached to this mail is your report, offering valuable feedback and insights regarding your performance. The report will outline your strengths, identify areas for improvement, and clarify our expectations for your future contributions.<\/p>\n\n\n\n

    CLICK HERE TO ACCESS REPORT<\/p>\n\n\n\n

    We encourage you to take the time to review your report thoroughly and address any questions or feedback with your manager.<\/p>\n\n\n\n

    Best regards,
    HR DEPARTMENT.<\/p>\n","protected":false},"excerpt":{"rendered":"

    Original Phishing Message From: Valentina Hernandez <ana[.]herediahernandez[@]austinisd[.]org>Subject: EMPLOYEE ASSESSMENT ANALYSlS Where did the link lead? The link led to a form asking for your credentials. Never submit your credentials in an online form or on websites you do not recognize. Though Jotform is a legitimate site that allows individuals to create forms, the service can […]<\/p>\n","protected":false},"author":521,"featured_media":1441,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[3],"class_list":["post-1439","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-the-phish-tank","tag-phishing"],"_links":{"self":[{"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/posts\/1439","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/users\/521"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/comments?post=1439"}],"version-history":[{"count":1,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/posts\/1439\/revisions"}],"predecessor-version":[{"id":1443,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/posts\/1439\/revisions\/1443"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/media\/1441"}],"wp:attachment":[{"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/media?parent=1439"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/categories?post=1439"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/tags?post=1439"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}