Credential phishing Charles Schwab account holders with 2FA bypass · Blog · Sublime Security

Sublime's Attack Spotlight describes a credential-phishing campaign impersonating Charles Schwab where recipients are lured through a fake Cloudflare challenge to a convincing phishing login that captures credentials and prompts for a phone number to intercept 2FA codes; Sublime detected the attack via signals such as a suspicious ".jp" sender TLD, credential-theft language, and mismatched sender/link domains and prevented the campaign.