After going down the rabbit hole and checking our phishing kits database, this is part of an old phishing campaign that we've seen early parts of last year.

Here is what happens after a user enters their credentials,