Fake Google Security site uses PWA app to steal credentials, MFA codes

A phishing campaign uses a fake Google Account security page to deliver a Progressive Web App (PWA) that steals credentials and MFA codes. The malicious PWA can exfiltrate contacts, real-time GPS data, clipboard contents, and act as a network proxy and internal port scanner. It uses WebOTP API to intercept SMS verification codes, checks /api/heartbeat every 30 seconds for commands, and includes a service worker for push notifications and data exfiltration. The attack includes a WebSocket relay allowing attackers to pass web requests through the victim's browser as an HTTP proxy. A companion Android APK with 33 permissions includes custom keyboard for keystroke capture, notification listener, credential interception service, device administrator registration, boot receiver, and overlay-based attack components.