A safeguard against this type of attack is to right-click on buttons and links, and open them in a new tab.

That means that you can end up with a lot of tabs open, but it really helps to unmask these types of attacks.

Ultimately, I think browser vendors should implement better patterns to discern actual windows from mimicked windows. For example, showing a personal secret signature in the UI above the "line of death".

The attacker won't be able to figure out the secret signature so only a legit browser window will be able to display it. Here is a quick wireframe of how it could work: https://cln.sh/0GbV3A