https://www.bleepingcomputer.com/news/security/phishing-adds-overlay-on-official-company-page-to-steal-logins/

A phishing campaign deployed recently at various businesses uses the company's home page to disguise the attack and trick potential victims into providing login credentials.

This is a new tactic, researchers say, that loads the legitimate page of the business and applies a fake login box on top of it.