If I'm an attacker, I'm not using this vulnerability to redirect you to an evil website, but instead to inject a fake login prompt. When you go to check the dom

If I'm an attacker, I'm not using this vulnerability to redirect you to an evil website, but instead to inject a fake login prompt. When you go to check the domain like a good user, you'll see it's on the Apple official website found.apple.com, perfectly safe to enter your credentials on! The ability to impersonate Apple _on their own domain_ is definitely a bigger risk than rewriting the URL or manufacturing a look-alike tag.