[hamhamed]

It's disabled if you do autocomplete=off in the attributes

[grandalf]

Not in my tests, it continued to aggressively populate forms with autocomplete="off" set.

[talmand]

That would be because that attribute is for a different feature of the browser. The autofill that this method takes advantage of is more of an extension beyond the standard browser feature.

Besides, someone using this for a phishing method wouldn't use that attribute anyway.