This is a proof-of-concept demonstrating how ElectronBridge.loadURL() could redirect users to a phishing page. No credentials were sent to any server. In a real attack, these would be exfiltrated.