LogMeIn phishing attack: How it steals user credentials