Purchase order attachment isn’t a PDF. It’s phishing for your password

This report details a phishing campaign where a malicious .pdf.htm attachment masquerades as a purchase order; when opened it presents a fake password prompt and silently sends submitted credentials and environment data (IP, geolocation, user-agent) to an attacker via a Telegram bot. The write-up includes screenshots of the email and phishing page, an explanation of the social-engineering technique (encouraging retry after a fake "incorrect password" message), and pragmatic mitigations: verify file extensions, access services via official sites or apps, enable multi-factor authentication, and use up-to-date web/antimalware protections.