The other week I was alerted to a PayPal login page that was being spammed as an HTML attachment (nothing new there) In this case the HTML forms within the page all referenced legitimate PayPal servers. The script was being used to validate user input entered into the various PayPal forms. Data from the customer signup form was serialized and stored in the variable cus_data. These variables were then sent back to the attackers by dynamically populating the empty iframe element (see above)”]
Source: https://nakedsecurity.sophos.com/2013/03/27/spicing-up-phishing-attacks/