@Intigriti Phishing link with modified icon parameter. Inject additional attributes into the link element as space is probably not disallowed by htmlspecialcharacters. Without reading the docs I don’t know what else

@Intigriti onload or another JS code attribute with a Beef hook probably