evil.com ad frame (cross-origin intermediate ancestor)

This frame is controlled by the attacker. It embeds victim.com/login.html: