We need to login to our wallet to receive the tokens?

Won't it leak out private keys?

Shady airdrop.