Scraping Login Credentials With XSS

This blog post demonstrates how an unauthenticated reflected XSS can be weaponized into an IFrame trap that presents a real or fake login page, scrapes user-entered credentials via injected JavaScript polling, and exfiltrates them to an attacker-controlled server; it includes implementation details, screenshots, and a linked gist, and cites OWASP mitigation guidance.