Browser autofill used to steal personal details in new phishing attack