We found a campaign that hosts fake login pages on Cloudflare Pages and sends the stolen info straight to Telegram.