Fake Google Security Alert Installs PWA That Steals MFA Codes

A phishing campaign posing as a Google Account security check is tricking users into installing a Progressive Web App (PWA) that functions as a full browser-based RAT — stealing MFA codes in real time, harvesting cryptocurrency wallets, and turning t...