If I understood it correctly, the snippet in TFA injects a return as well, so by the time you give the second look, the commands had already been executed. In

If I understood it correctly, the snippet in TFA injects a return as well, so by the time you give the second look, the commands had already been executed. In a following snippet, the terminal scrolls 100 lines and prints no prompt, so a user is tempted to press Enter just to check what's going on. You can count this as a form of phishing, if you want.