That's a regular MitM attack, just with, specifically, Angular. If you can convince someone to go to malicious-bank.com and log into it with their real credentials, you've successfully phished them. If you go a step further and show them the real information from the real website, thats going a step further, but by then it's game over already.
If the attacker's already convinced you to give them your username/password (and 2fa), why bother showing the victim a fake (Angular) website?
A password manager/passkey/yubikey protects against this by checking that the url is bank.com and not malicious-bank.com, but unsophisticated users fall for this attack every day.
If the attacker's already convinced you to give them your username/password (and 2fa), why bother showing the victim a fake (Angular) website?
A password manager/passkey/yubikey protects against this by checking that the url is bank.com and not malicious-bank.com, but unsophisticated users fall for this attack every day.