The fake pop-up window isn't new. This does seem a fairly well engineered version of the trick, but sites have been pulling this shit since the 90s. It has been a while since I've seen it though, but then I use an ad blocker so I suppose I wouldn't.
Yeah, and this one isn't any better in that regard. Was just examining it on a Mac, where it uses the same Windows UI style.
One should think that malware authors would have already implemented some JS library of sorts for their fake popups that fakes Windows, MacOS and Linux UI styles more convincingly.
Especially since they've applied serious thoughts to other parts of the fake, like the language chooser in the fake Steam popup. It causes a spinner for a short while and then an error popup saying something like "cannot communicate with Steam server". Nice idea to dead-end page components that they didn't want to fake more convincingly.
Unthemed Windows & Mac OS will be convincing to a lot, Linux will be pretty hard. Then again those who tinker with their computers are unlikely to fall into this trap.
This specific phishing website mimics an ingame website for Counter-Strike Global Offensive, a shooter game with the vast majority of players using Windows. Linux isn't supported at all and while the game technically runs on a Mac most people don't (or play it with Bootcamp).
I would not be surprised if 99% of the audience for this website is using Windows, the vast majority with default themes (and the ones without either won't notice this or think Windows is buggy when a popup shows the default theme).
I think the new thing is that they implemented chrome dev tools in the popup window in a convincing enough manner. This sounds far more extreme then any previous example I have heard of on the web.
