The phishing attacks were generated by a Python tool which produced custom webpages designed to mimic websites like online banking and social networking sites. The developer of the tool, Australian researcher Jamieson O’Reilly, said the attacks exploit users who are accustomed to remaining signed into web sites via session cookies. “The general user [finds] it normal to just open a browser and be already logged in which is where this vector takes advantage,” O’Reilly said.