The Fake Security Checkup: How a Rogue ‘Google’ App Hijacks Your Digital Life

Malwarebytes Labs documents a phishing campaign that uses a convincing fake Google security check delivered as a Progressive Web App (PWA) to obtain persistent permissions and a service worker that exfiltrates contacts, GPS, clipboard data and relays attacker traffic; victims are further coaxed into installing a malicious Android APK that installs a keylogger, abuses accessibility to read screens, intercepts SMS 2FA, and can be used to scan internal networks. Users are advised to ignore unsolicited security pop-ups and verify account status directly at myaccount.google.com.