Attackers Harvest Dropbox Logins Via Fake PDF Lures

Forcepoint reported an active phishing campaign that sends a PDF lure leading to a blurred invoice hosted on legitimate cloud infrastructure; that document contains a link to a convincing Dropbox credential-phishing page which captures login details and system/location data (sent to a Telegram bot). The attack uses spoofed or compromised internal email addresses and legitimate hosting to pass SPF/DKIM/DMARC and evade detection, contains no malware, and Forcepoint published IOCs and mitigation advice.