Hackers steal banking creds from iOS, Android users via PWA apps

Security researchers (ESET) documented active phishing campaigns that abuse progressive web applications (PWAs) and WebAPKs to impersonate banking apps and harvest credentials from Android and iOS users. Attackers use automated calls, SMS (smishing), and malicious social-media ads to lure victims to fake store pages or directly install PWAs; the campaigns target multiple banks in Europe and exfiltrate stolen data via distinct C2 infrastructures or Telegram, while evading native app-store installation warnings.