On a similar note, check out this PoC I found that steals Matrix credentials: https://github.com/mishushakov/signin-with-matrix