Overview
Amid increasingly sophisticated cyberattacks, a new phishing campaign has emerged, highlighting a notable shift in methods used to steal user accounts. Instead of exploiting traditional software vulnerabilities, attackers are leveraging legitimate features of modern browsers—particularly Progressive Web Apps (PWA)—to create highly convincing phishing scenarios. This campaign impersonates the "Google Security Check" page, preying on fears of account breaches. Users are prompted to install a web app in the form of a PWA under the guise of "security verification." However, once installed, this app can function as an intermediary platform to collect login credentials, multi-factor authentication codes (MFA/OTP), and other sensitive data.
Progressive Web App (PWA)
Introduction to PWA
Progressive Web App (PWA) is a web application model that allows websites to function like native apps (apps installed on a device).
PWA combines:
HTML5 + CSS + JavaScript
Service Workers
Web App Manifest
Cache API
One point to note is the technical structure of a PWA in the JSON file when declared:
When in standalone mode, a PWA will not display the address bar and will resemble a native app. This is the key factor that attackers will exploit.
Why is PWA dangerous in phishing?
No URL bar
Feeling "installed"
Difficult for the average user to detect
Details of the campaign
As mentioned, in this campaign, the attacker will aim to steal Google login information, collect OTP/MFA codes in real time, maintain account access, and potentially use the victim as an intermediary proxy. The first stage is distribution, where the attacker will send:
Fake security alert emails.
SMS messages.
Malicious advertisements.
Redirects from infected websites.
The content often carries an urgent tone, such as "Your Google Account has been compromised," to exploit the user's fear. The victim will then access a malicious, fake domain with:
Interface identical to Google Security Check
Includes logo, layout, and authentic-looking CSS
This website will display "Install Google Security App to verify your account." This site uses:
manifest.json
Service Worker
Display mode:standalone
After clicking "Install":
In the next stage, the process of collecting credentials begins. Here, the PWA will display: Email field and Password field. All information will be sent directly to the attacker's server or transferred via WebSocket. Every attack has mechanisms to bypass AV defenses, and this is no exception. The hacker group cleverly uses the credentials obtained in the previous step to attempt a login. Naturally, Google sends a real OTP to the victim, and the fake PWA is ready to display:
“Enter the verification code sent to your phone”
The attacker also skillfully exploits the WebOTP API. The PWA can:
OTP received:
After bypassing the MFA mechanism, the attacker will maintain access. Once logged in successfully, the attacker can:
Add recovery email.
Create app password.
Add trusted device.
Export session token.
Then the PWA continues to run in the background and performs:
At this point, the victim's browser is turned into an intermediary node. Finally, the attacker will deploy the ANDROID MALWARE "sync.apk".
If the victim installs it, the malicious Android app can:
At this point, the attacker:
Conclusion
The fake Google security alert campaign highlights a concerning reality: modern attacks no longer rely on technical vulnerabilities but on gaps in user awareness. The attacker doesn't need to break Google's security system. Instead, they trick users into voluntarily installing malicious apps, granting access, and providing OTP codes—all under the guise of "account protection." Exploiting Progressive Web Apps (PWA), WebOTP, and push notification mechanisms reveals a new trend in phishing:
In the digital age, social engineering is becoming the most effective "weapon." A single careless click can turn a browser into a proxy for hackers, a phone into a controlled device, and a personal account into an entry point for deeper attacks.
Recommendation
1. Always verify the source of access.
2. Do not install PWAs from unfamiliar sites.
Progressive Web Apps (PWAs) can appear like real apps and lack an address bar, making it difficult to verify the URL.
If a website asks you to click "Install App" to continue:
How to check and remove PWAs:
Chrome (Desktop):
Android Chrome:
- Go to Settings → Apps → find any unfamiliar app with a web icon → Uninstall
3. Do not grant excessive permissions to websites.
4. Be cautious with OTP/MFA codes.
Golden rule:
Do not enter OTP on pages accessed from unfamiliar links
Do not share OTP with anyone
If you're logging in and it's not you → change your password immediately
Security Upgrade:
Use an Authenticator App instead of SMS
Use a Security Key (FIDO2) if possible
Enable alerts for unusual logins
5. Absolutely do not install APK files from websites.
IOCs
Hash
- 1fe2be4582c4cbce8013c3506bc8b46f850c23937a564d17e5e170d6f60d8c08
Domain
Reference
Inside a fake Google security check that becomes a browser RAT | Malwarebytes
Google: Fake Google Security site uses PWA app to steal credentials, MFA codes
Fake Google Security site uses PWA app to steal credentials, MFA codes
