If this was purely a CSS injection—as I understand it was—then I don't think it would be possible to redirect on any technical level the user anywhere (e.g. by

If this was purely a CSS injection—as I understand it was—then I don't think it would be possible to redirect on any technical level the user anywhere (e.g. by providing a link). But telling user to do something would still be on the table.