Explanation
In this phishing attempt, the threat actor uses an HTML file, instead of using a fake web page. Such files are usually opened by a browser or directly by an e-mail client. HTML phishing files are similar to fake phishing web pages.
In this case, the e-mail client displayed the content of the HTML attachment. A fake login form is presented and a potential victim is led to believe a password is needed to verify the content of an invoice.
Behind the scenes, the password entered is submitted to a fake domain - hxxps://nistairlifts[.]co[.]uk/Opentex/script.php
There is no difference in opening the HTML file from the e-mail client or in a browser.
Example
