The people I've seen this target mostly use Chrome and aren't extremely tech literate - they'll hover the sign-in link, would see a real Steam or Microsoft URL

The people I've seen this target mostly use Chrome and aren't extremely tech literate - they'll hover the sign-in link, would see a real Steam or Microsoft URL and a very convincing fake popup. You really only notice if you try to move them out of the window, if you're not paying a lot of attention. This is one of the primary methods Discord scammers phish for accounts nowadays, and it still seems to be extremely effective.