As a side note, it looks like this couldn't have happened with an external mail reader like Thunderbird. Even when targeted to that and mocking some other UI element, clicking the link would open a browser window and reveal the fraud, at least to power users.
I'm not advocating against web-based mail readers, simply because it's not always possible or practical to use external ones. But it seems security is harder to implement because everything is "made of the same parts", i.e. a web-based mail displayed in a web-based application, opening links in the same (browser) window.
I'm not advocating against web-based mail readers, simply because it's not always possible or practical to use external ones. But it seems security is harder to implement because everything is "made of the same parts", i.e. a web-based mail displayed in a web-based application, opening links in the same (browser) window.