Stage 2 phishing landing page hosted on Vercel; collects victim PII, Meta account password, and real-time 2FA token for immediate account takeover