Remove “Leave Request Form” email

The “Leave Request Form” email is part of a phishing campaign that tries to phish users’ email login credentials. The email is disguised as a message from the HR department, supposedly sending recipients the leave request form for June 2025. This phishing campaign is sent on a massive scale to random users in the hopes that someone is expecting a similar email from their employer and will thus open it. It does not appear to be a targeted attack that targets a specific company or person. Users who interact with the email will be taken to a phishing site that asks them to log in to their email accounts. If users type in their password, it will be stolen, allowing malicious actors to access the email account if no additional security measures are implemented (e.g., two-factor authentication).

 

 

Malicious phishing campaigns that target email account login credentials are common because this information is of high value to cybercriminals. While phishing emails are often very obvious and easy to identify, all it takes is the right timing and circumstances for someone to fall for it. Emails from this particular campaign claim that the recipient’s company’s HR Department has sent out the leave request forms for June 2025, which can be filled out by clicking on the provided link. If someone who’s waiting for a similar email from their employer receives this phishing email, they may not hesitate to click on the provided button.

The full “Leave Request Form” email is below:

Subject: – Leave Request

– Leave Request Form

– HR has shared the latest document,
“Leave Request Form- June 2025,” with you.

Fill Out Leave Form

When users click on the “Fill out leave form” button, they are redirected to a fake email login page. According to the pop-up, users need to be verified by typing in their email password because they are about to access a sensitive document. This deceptive site may trick users who are in a hurry and were expecting a similar email from an employer. If users type in their passwords here, their credentials will be instantly stolen. The cybercriminals behind this phishing attempt may either use these credentials to access the accounts or sell them to other malicious actors, resulting in users losing access to their accounts either way.

There are several reasons why malicious actors target email login credentials so persistently. Accounts that have been used for years often contain a wealth of personal and sensitive information that can be exploited for various malicious activities and even blackmail. Additionally, email accounts are typically linked to many other accounts, so gaining access to an email account can also lead to hijacking those connected accounts.

If you’ve clicked on the email link, entered your password, or interacted with it in any way, your password must be changed immediately. Should you be unable to access your account and recovery options fail, disconnect your email from all associated accounts to prevent further hijacking.

How to recognize phishing emails

This particular phishing campaign is very specific, but it does not appear to be targeted. Unless users are expecting a similar email from their employer, it’s not likely that they’ll open it. It’s worth mentioning that unless you’re the intended target of a specific phishing campaign, you’ll mainly come across generic malicious emails. These types of emails are usually easy to spot since they’re not personalized.

Phishing emails, like the “Leave Request Form,” can typically be identified with a simple check of the sender’s email address. In this case, even if you were expecting a similar email, if it doesn’t match your company’s official email address, it’s not legitimate. However, keep in mind that malicious actors often try to imitate legitimate email addresses, so be very careful and watch out for additional or changed letters.

It should also be mentioned that generic phishing emails often contain grammar and spelling mistakes. Those mistakes stand out because senders often claim to be from legitimate companies. Although the “Leave Request Form” email may not have obvious mistakes, mostly because there’s very little text, it does not look professional enough to be sent by any company. Additionally, the email uses the recipient’s email username to address them, and that’s an immediate giveaway. Malicious emails often use words like “Users,” “Customers,” or “Members,” or don’t address recipients directly at all. In contrast, legitimate emails usually greet recipients by name, adding a personal touch to the correspondence.