Anatomy of a Low-Detection Credential Phishing Campaign

description: "Deep-dive reverse engineering analysis of a sophisticated HTML-based credential harvester spoofing a corporate domain with only 1/26 AV detection." ⚠️ Threat Level: HIGH | Detection Rate: 3% (1/26) | Type: Credential Harvester + Geo-IP Exfiltration Executive Summary On April 29, 2026, a targeted phishing email was received purportedly from [email protected] — a lookalike domain spoofing a legitimate corporate identity. The attachment, named Tax Invoice PDF.SHTML , is a highly obfu