Called it?

Nasty phishing attack leveraging the browser fullscreen API.

It’s clever, though kind of obvious on my laptop. I run Linux and the window borders are different once in fullscreen (different shape and color).