> "The whole thing was just a drawn up window inside the phishing website!"

This reminds me the "Phishing Alert Toolbars" section from Ross Anderson's "Security Engineering" book on what he calls a "picture-in-picture website" [0]

[0] https://www.cl.cam.ac.uk/~rja14/Papers/SEv2-c02.pdf