[lifeformed]

Another attack is to rewrite the webpage to show the official login screen for that site, and record their password when they enter it.