APT28 has set up a credential harvesting operation using domains that mimic legitimate login portals. User traffic is being redirected to these domains following a successful phishing campaign. The captured credentials will allow the adversary to escalate their access within the network.