It's not a pop-up, it's a browser simulated with DOM elements inside the page. The attack bets that you don't notice that it's not actually a new operating system window and instead is just a part of the page you're on. The author includes default "skins" for both windows and macOS.
