THIRD-PARTY EMBED (the attacker)
TAP HERE
— gives this frame unambiguous browser-level focus. Then type one character to confirm it really landed here.
typed here:
(nothing yet)