Account takeover via insecure intent handling