I was phished for coinbase just recently with an email telling me "You just received 0.08525920 BTC" and just "Click here to sign in and view this transaction" and I stupidly I did click on the link and did try to log in. The login failed (as it would with a trojan and the coinbase 2 factor authentication I have enabled). But even so, the phishing site was able to attach 3 Android apps to my account with full access. I deleted the apps and notified coinbase, but they were totally less than helpful.