How credentials get stolen in seconds, even with a script-kiddie-level phish

A Malwarebytes piece from 11 November 2025 describes a crude phishing attack that still proves highly effective due to its front-end simplicity. The email uses a fake Po or invoice scenario, with the attacker’s address linked to a likely compromised Czech printing service and a counterfeit name and phone number, targeting a Taiwan-based recipient.

The attack hinges on a tidy .shtml attachment that presents a fake login screen and routes any entered credentials to a Telegram bot, delivering them instantly to the attacker. The article notes that the phishers exploit Telegram’s legitimacy and distribution to avoid easy blocking, and reveals a sloppy decryption stub was left in the code after the attacker shifted from encrypting credentials with a hardcoded AES key to the Telegram method.

A two-second delay attempts to open a non-existent file via a file URL to make the login flow feel more legitimate. Practical tips include not opening unsolicited attachments, verifying sender addresses, and using up-to-date security software and multi-factor authentication.