Cybercriminals prey on corporate credentials by sending fake HR emails.