[asadotzler]

Easy enough to drop a remote access app or a fake Paypal app and let the idiot user put their credential into it.