I don't see how I would fall for this. My credentials are automatically filled in by Safari on gmail, so that would be my first clue something was up, and the U

I don't see how I would fall for this. My credentials are automatically filled in by Safari on gmail, so that would be my first clue something was up, and the URL hasn't changed and I ALWAYS double check that before entering credentials anywhere. However it is an extremely clever new attack vector, and I don't know how browser manufacturers can stop this attack.