3 ms·

Step 1 and step 3 are "trick the user". That alone should make it clear the real vulnerability is social engineering, and not a software flaw.