I think the dangerous is not phishing for credentials but malware. The example is a Github Link to a release. You click on the link expecting to download the l

I think the dangerous is not phishing for credentials but malware. The example is a Github Link to a release. You click on the link expecting to download the legitimate kubernetes relase zip file. But instead you end up with a patched version with an e.g. included monero miner. A less tech-savy or distracted user would also fall for a .exe file that downloads and just click on it since he just expects a zip file from github.