Phishing emails disguised as spam filter alerts are stealing logins

Malwarebytes analysed a phishing campaign that spoofs internal “email delivery” notifications to lure users to a phishing site (hosted on mdbgo.io via cbssports.com redirects) which pre-fills target domains and harvests credentials in real time using obfuscated JavaScript and websockets; the report includes multiple IOCs and mitigation advice.