"The attack will appear as though someone has left you a comment, but an image similar to the following will appear requesting your password:" Without knowing

"The attack will appear as though someone has left you a comment, but an image similar to the following will appear requesting your password:" Without knowing anything about the attack my guess is that the author is probably confused with XSS.