That's rather specifically not the same attack. One uses the normal OAuth flow and mis-represents a valid application identity in order to get the user to gran

That's rather specifically not the same attack. One uses the normal OAuth flow and mis-represents a valid application identity in order to get the user to grant permissions normally. The other flow, that the grandparent refers to, redirects users to a phishing domain and steals credentials.