A company's customers report receiving emails that appear to come from the company, complete with its logo, colors, and branding. The emails direct users to a website that closely mimics the company's real login portal to harvest credentials. Which threat vector best describes this activity?