New Password-Stealing Phishing Campaign Targets Corporate Dropbox Credentials

Forcepoint X‑Labs warns of a multi-stage phishing campaign targeting corporate users: short procurement-style emails prompt recipients to open PDFs containing AcroForm links that lead to a fake Dropbox login hosted on legitimate cloud infrastructure. The attackers harvest credentials submitted to the spoofed page and forward them to a Telegram channel for account takeover and potential follow-on attacks, using techniques designed to evade email authentication and automated scanning.