PNB MetLife Phishing Attack: Multi-Stage Scheme Steals Data, Triggers UPI Payments

**Executive summary:** A multi-stage mobile-optimized phishing campaign is actively targeting PNB MetLife customers using fake payment gateway pages hosted on EdgeOne Pages and Telegram bots (@pnbmetlifesbot, @goldenxspy_bot) to exfiltrate policyholder data and banking credentials in real time; the attack forces UPI payments via QR codes and clipboard abuse and escalates to full credential harvesting, with operators using accounts such as @darkdevil_pnb and @prabhatspy — defenders should block malicious EdgeOne subdomains, monitor Telegram indicators, and educate customers to avoid SMS payment links.