Scammers prod employees to take performance appraisals but in reality siphon off their work account passwords.