For Android users, clicking the install button triggers a WebAPK installation – bypassing any warnings about unknown apps due to some Chrome functionality that the phishers are exploiting.