The Beluga phishing campaign uses .htm files to capture your company OneDrive credentials.