Phishing Scam Uses Big-Name Brands to Steal Logins

According to Cyble Research and Intelligence Labs (CRIL), a sophisticated phishing campaign is using big-name brands to steal credentials by delivering HTML attachments that masquerade as procurement documents or invoices. The emails carry HTML files such as RFQ_4460-INQUIRY.HTML that, when opened in a browser or PDF viewer, display a login prompt over a blurred invoice background, with branding often themed after Adobe or other trusted brands.

Once credentials are entered, a JavaScript routine collects the email and password along with device IP and user‑agent data, exfiltrating it to attacker‑controlled Telegram bots via the Telegram Bot API using HTTP POST requests. Two representative malware samples illustrate the campaign’s sophistication: one uses CryptoJS AES encryption and redirects post-capture to a legitimate Adobe site, while the other uses the Fetch API and suppresses forensic tools to prompt repeated input.

The operation impersonates global and regional brands such as Adobe, Microsoft, WeTransfer, DocuSign, FedEx, DHL, Telekom Deutschland and Roundcube, and appears most active across Central and Eastern Europe, including the Czech Republic, Slovakia, Hungary, and Germany.