Inside a purchase order PDF phishing campaign

This report analyzes a phishing campaign where a PDF attachment redirected recipients to an IONOS Cloud–hosted fake login page that harvested business credentials and detailed client metadata (browser, OS, cookies, location) and immediately exfiltrated the data to a Telegram bot (hardcoded chat ID 5485275217); the analyst deobfuscated multilayered JavaScript to reveal the harvesting and provided standard mitigation advice.