I want to know the answer to the following question:
Where are the clicks meant for the top level page routed?
All the background I'm provided with is that "Carefully drafting a combination of stylesheets, iframes, buttons and text boxes, a user can be led into believing that they are typing the password or other information on some authentic webpage while it is being channeled into an invisible frame controlled by the attacker.". Is that enough to answer the question?