[EXTERNAL]

The email contains a DOCX attachment themed as a 2026 performance and compensation review for the recipient, a common HR/payroll lure. Deep attachment analysis found an embedded link to an n8n.cloud webhook branded as a secure portfolio/review access page. Browser analysis confirmed the link is malicious: it presents a Microsoft OneDrive-themed verification/download lure on an unrelated domain and redirects to a Zoho-hosted landing page that serves an executable file named statement.exe while advertising a PDF/document. This is a multistage attachment-to-link malware delivery campaign with brand impersonation.