...unless it is a text that the attacker shows to another user, in which case they can trick this user to perform some action (send cryptocurrency,...).