Mobile Phishing Attacks Use New Tactic to Bypass Security Measures

ESET warns that attackers are increasingly using PWAs and WebAPKs in mobile banking phishing campaigns: lures delivered via SMS, voice calls, and social-media malvertising direct victims to fake banking apps that don’t trigger normal mobile security prompts, capture credentials and intercept MFA codes, and transmit stolen data to attackers’ command-and-control servers.