Holi Offer or Hacker Trap? One Click Could Cost You Everything