Purchase order attachment isn’t a PDF. It’s phishing for your password

A fake purchase order attachment turned out to be a phishing page designed to harvest your login details.