They could just use puppeteer? I don't see mention of puppeteer anywhere. Even if they block puppeteer, hackers could create a chrome extension to automate the

They could just use puppeteer? I don't see mention of puppeteer anywhere. Even if they block puppeteer, hackers could create a chrome extension to automate the login flow presenting the victim with phishing page for each step of the login flow.