> The URL bar shows the malicious site either way That's never been sufficient to keep bad actors out because end-users don't grok the URL bar. This attack is

> The URL bar shows the malicious site either way That's never been sufficient to keep bad actors out because end-users don't grok the URL bar. This attack is superior to a mirroring attack because it uses the target site's own UI resources, so it looks very legit (no need to pay someone to monitor the UI of the target site for changes and rework your exploit to attack them).