They won&#x27;t get secure cookies [for the site they&#x27;re attacking], though they could plausibly redirect the user to a similar-looking HTTPS domain under their control and get permissions requiring a secure origin.