Attackers invite employees to complete fake self-evaluations to steal corporate credentials.