Immediately after page load, this attacker page navigates to a URL with an SSL error. This causes the URL in the address bar to update with a positive HTTPS indicator, but no navigation occurs. Therefore the attacker page remains fully interactive. All permission prompts by the Status app also use the spoofed URL.
The attack works with a myriad of SSL error conditions, such as:
Note that when tapping the links above, the loading indicator is shown again. However, on page load, the loading indicator is not shown again since it's already being shown for this attacker page. Therefore, on page load, the attack is not detectable. The attacker page can also change the page contents if the loading indicator is shown after page load to simulate a real navigation.