> And this is pretty visible to the user too

How would even a tech savvy person know of this going on in the background, without being suspicious a priori? Embedded frames can be made invisible, overlaid with something else, or put off-screen. You'd have to be very familiar with this attacker's site to know that it's unusually slow today and loading longer than usual, or showing it's loading while the page appears to be already fully loaded. With the gigabytes of javascript that are common nowadays, that's not unusual.

The riskiest part is probably the sharing, as email notifications of such actions are commonly sent out.