fig5_malicious-app-stole-login-token