Paubox blog: HIPAA compliant email - easy setup, no portals or passcodes

Phishing actors use global brands to harvest user credentials

Written by Farah Amod | November 30, 2025

A new phishing campaign is using fake brand-themed login pages hidden inside HTML email attachments to harvest user credentials.

 

What happened

According to GBHackers, researchers have identified an advanced phishing operation that uses realistic HTML attachments disguised as invoices or procurement documents to bypass traditional email filters. The campaign targets global and regional businesses by sending attachments named like RFQ_4460-INQUIRY.HTML, which appear to be standard business documents.

When opened, these attachments prompt users to “sign in to view” the file, imitating familiar login screens from trusted brands such as Adobe, Microsoft, and WeTransfer. Once a victim enters their credentials, the information, along with IP and device data, is silently exfiltrated via Telegram bots, a method that avoids traditional detection systems.

 

Going deeper

The phishing emails contain no external links or obvious red flags, as the malicious code is embedded directly within the HTML file. Once executed, it launches a JavaScript process to collect user data and send it to attacker-controlled Telegram channels using the Telegram Bot API.

Researchers analyzed two distinct samples from the campaign:

  • Sample 1: Uses AES encryption through CryptoJS, requires users to re-enter credentials for higher capture success, and redirects victims to a legitimate Adobe page afterward.
  • Sample 2: Employs the Fetch API for data exfiltration, includes fake “login invalid” errors to trick users, and contains anti-forensic features that block inspection tools and keyboard shortcuts.

The phishing templates impersonate a wide range of global brands, including Adobe, Microsoft, DocuSign, FedEx, DHL, and Roundcube. Each variation is regionally localized for realism. The campaign is most active in Central and Eastern Europe, affecting industries such as manufacturing, healthcare, government, IT, and construction, sectors that frequently exchange documents by email.

 

What was said

Researchers described the operation as a “modular and scalable threat,” noting that the attackers’ toolkit allows rapid brand switching and language customization. Telegram’s API is being used as a decentralized exfiltration channel, complicating detection and mitigation.

Security experts recommend blocking HTML attachments at the email gateway, restricting access to Telegram APIs, and reviewing recent user activity for anomalous sign-ins.

 

The big picture

Attackers are getting better at hiding inside everyday business workflows, and this campaign shows how far they’ve pushed it. Instead of suspicious links or poorly written emails, the entire trap sits inside a clean-looking HTML attachment that most filters allow through. Because the login pages mimic trusted brands and send stolen credentials straight to Telegram, the scam slips past many legacy tools that only look for known domains or external URLs.

Since phishing remains the top way attackers break into healthcare and enterprise systems, organizations need inbound email protection that doesn’t rely on static checks. Paubox Inbound Email Security analyzes behavior inside attachments, blocks credential-harvesting pages before they reach users, and stops these “brand impersonation” HTML phish even when they look perfect on the surface.

 

FAQs

Why are attackers using Telegram bots for data theft?

Telegram’s Bot API enables direct data transmission without needing traditional command-and-control servers, making detection and blocking much harder for security tools.

 

How does embedding malicious code inside HTML files help attackers?

Embedding code inside the file allows phishing emails to bypass URL-based detection systems and appear benign until opened locally.

 

Why are phishing campaigns increasingly region-specific?

Localized branding and language significantly increase the success rate, as recipients are more likely to trust communications that reflect their regional context.

 

What industries are at higher risk from this campaign?

Sectors that frequently handle invoices and procurement documents, such as construction, government, IT, and manufacturing, are prime targets.

 

How can organizations defend against similar phishing threats?

Implementing attachment scanning, blocking HTML file types, monitoring Telegram traffic, and reinforcing user education around suspicious document prompts are defense steps.