CoPhish attacks do not require forging any pages; instead, they register malicious applications directly on the real platform and exploit the platform's own trusted domain name and interface appearance to initiate authorization requests.