AFAICT it’s not a popup. The “window” is actually a DOM element designed to look like a window floating over the web page. The entire “window”, url bar and all,

AFAICT it’s not a popup. The “window” is actually a DOM element designed to look like a window floating over the web page. The entire “window”, url bar and all, is just a cleverly disguised part of the phishing website.