"The attack will appear as though someone has left you a comment, but an image similar to the following will appear requesting your password:"

Without knowing anything about the attack my guess is that the author is probably confused with XSS.