In the original Dutch article (https://decorrespondent.nl/845/Dit-geef-je-allemaal-prijs-al...) the author explained in the comments that they used SSLstrip for facebook and live.com
So, the connection was over HTTP and not HTTPS.
They added a padlock favicon.ico image to give the impression the site was secure