<!-- PRETEXT OVERVIEW:
Credential capture.
$greeting: Good morning/afternoon/evening, etc.
$firstname: Target first name.
$organization: Target organization.
$evilurl: URL to cloned vpn or benefits portal.
$hremployee: Name of HR employee.
$evildomain: Spoofed domain.
$signature: Append or replace with internal signature if acquired.
$name: Target first and last name.

Most successful when used between Jan - End of March.
Can be sent as hr@domain.com
Make sure to setup the inbox so users can reply to this m