the WORST phishing email i've ever seen

A detailed walkthrough of a sophisticated phishing campaign that abuses legitimate Facebook Business Manager email notifications. Attackers register business accounts with names like 'Your account will be locked in 24 hours' so the threat appears in official Facebook emails. The phishing sites are built with Next.js/Webpack, collect credentials via an encrypted API endpoint, and exfiltrate data to Telegram server-side. The analysis covers the email lure mechanics, live site inspection, network traffic analysis, base64/OpenSSL encrypted payload decoding, and JavaScript source debugging to trace the data exfiltration path.