Hacker News Reader

How is this different from just copying the Google login page to a website you control, with a URL that includes the right words?

It is not that different, but the art is in the attention to details (the sender can be posed as your colleague) and subtlety in execution.