(cont. because I posted a little soon without finishing my thoughts)
Also, every instance of this hacker that I've seen shows him explicity telling the recipent of the message to change their password to a specific set of letters to help "verify" their account. This should be an immediate red flag to anyone with basic internet safety knowledge. It's incredibly jank social engineering. Obvious bullshit, and yet, there's a bunch of people who thought it was legit.