Fake login prompts (identical to real site) - Fake software update notifications - Clipboard hijacking (replace copied content) - Tab nabbing (change inactive tab content)