Why would you need to sign in if you're already in your gmail? Not to say there's anything obviously wrong, one could easily go there.

It does point out a major problem. Email used to be text only. Then we added attachments that needed to be saved as a file and read with whatever app. Then we went to automatically displaying attached images and having live HTML links. All of these things we do for convenience make this sort of attack more possible.