This requires the attacker to have third party content on the page you are trying to get the user to scroll through, that is a huge assumption no?

The password web page example is here highly unlikely: if the attacker injected his external content on the password web page, he has already a very strong position - getting users to click on links is not a logical next step, the attacker has far better avenues I would assume.

At least that's my understanding.