Looks like trying to move the "popup" is a great way to defeat this kind of thing for now.
Me: Okay mom, if you ever get a popup that you were not expecting, try to move it outside of the browser before clicking on it. If you can't, it's fake.
mousedown is an event yes. So is mouseover. I'm not even sure why any action is necessary though. If you can present the popup, you can just feed a <script> tag to the browser and do whatever the click was going to do, right?
Me: Okay mom, if you ever get a popup that you were not expecting, try to move it outside of the browser before clicking on it. If you can't, it's fake.
Fairly simple, for now.