HACKERS STEAL BANKING CREDENTIALS FROM IOS, ANDROID USERS VIA PWAS

Summary from the TLDR InfoSec newsletter

A new trend in phishing campaigns is to use progressive web apps (PWAs) to trick victims into entering banking credentials. The campaigns being tracked are using bogus notifications to update banking apps or ads on social media to download a bank's application to earn a promotion. The victim is then directed to a fake Google Play or App Store page that downloads the PWA which mimics the official app and steals the victim's credentials. The benefit of this method is that attackers can bypass App Store or Play Store restrictions.