Edit: I get it, it was a pw+top phishing/proxy attack.

Wouldn't have happened if they used passkeys or a password manager. Things that get dunked on here regularly. Hm.