Such a user would be fooled by a plain old phishing attack then and there'd be no need for such sophisticated methods.