[cjaybo]

Saw an interesting case of this type of attack in the CounterStrike community earlier this week.

Someone setup a fake tournament website that asked the user to login with their Steam account. Then it launched what looked like a new browser window with the Steam login page, but was actually just a popover that had been elaborately styled, with window decorations and all.