CISOs need to warn employees in regular awareness training to refuse to copy and execute so-called verification login scripts.