The interesting thing about the phishing site is that it is hosted on the domain of a legitimate enterprise in Brazil. The address bar is not tampered with, and this can be seen. Otherwise, it is a pretty plain two-stage (a pseudo-login screen, followed by information request page) phish:
The presumption is that the scammers have obtained remote access to this server by using some kind of malware.
The second page demands the bulk of the information:
The ATM number will be superficially checked (with a publicly available formula), but no further checks are made. If the site approves the number, it will redirect to the legitimate bank page, saving the phished information locally.
