Your data was sent off in the very moment you clicked "Log in" — to a server that has nothing to do with this page:
The nasty part: this page ran completely separated in your browser. No AI system, no callback. The evil was already inside the code itself — like a note inside a letter.
This is where the demo ends. Nothing was actually sent — the recipient is a harmless example address. But a real attacker would have a real server, and your real data.