Address bar shows hp.com. Browser displays scammers' malicious text anyway