Attacker iframe (origin =
)