While performing online banking through a browser, your friend receives a message containing a link to a website. Upon clicking the link, a new browser session opens, displaying a funny video. A few hours later, your friend receives an email from the bank, stating that his account was accessed from another country and an attempt was made to transfer funds. The bank asks him to confirm the transfer. What vulnerability did the attacker exploit to attack your friend?