A phishing campaign detected in mid-March 2026 uses React-built credential harvesting pages and routes stolen credentials through EmailJS, a legitimate email delivery service, rather than attacker-controlled infrastructure. This design bypasses two common defensive layers: static content inspection and outbound SMTP/domain blocklists. Any organization whose users receive email lures mimicking trusted services is at risk of credential theft that leaves no trace in standard email security or proxy logs.