Threat actors have attempted to create these fake SSO windows using HTML, CSS, and JavaScript in the past, but there is usually something a little off about the windows, making them look suspicious.

Create a new bookmark, pasting the prefixed and encoded snippet in the URL field. To illustrate, I created the following line of JS to scroll to the top of a webpage: window. scrollTo (0, 0); ...