Additionally, the malicious web injection could very easily be confused with a real request to enable two-factor authentication, especially by users who might have been made a tad paranoid about their personal security by the recent Heartbleed crisis.