An attack using this tool does require that the user actually logs in, but because they’re just acting as a proxy for the real login page, the only way you’d spot the difference is if the URL doesn’t match (or that your password manager doesn’t auto-fill)
However, it’s pretty easy to see that someone would be fooled by that as you’d expect to need to confirm your identity when adding a gift card to your steam account.
=> More informations about this toot | View the thread | More toots from Godort@lemm.ee
=> View ReversalHatchery@beehaw.org profile
text/geminiThis content has been proxied by September (3851b).