AI-Generated Phishing No Longer Needs Malware: It Can Steal Your Session Inside the Browser