"Protected document" invoice sign-in kit that sends credentials to Telegram

Credential phishing kit that poses as a protected document: an Adobe sign-in box over a blurred invoice from a made-up company, with the invoice number, dates and amount due shown beside the form. The victim's email address is filled in from the link they were sent. Everything typed is sent to the operator through Telegram, and the page then shows an "invalid credentials" error with a reference number whatever was entered, so victims try again with other passwords. The page is translated into 20 languages and picks one from the browser or the visitor's location. The kit sits in a folder on compromised websites and is reached through newly registered redirect domains such as invoice-adobe[.]com. A match means a page carrying the kit, or a scan of a known redirect domain.