---
title: "Discussion on \"Fake Google Security Alert Installs PWA That Steals MFA Codes\" | Hashnode"
description: "Discussion on \"Fake Google Security Alert Installs PWA That Steals MFA Codes\". A phishing campaign uses google-prism.com to install a fake Google security PWA that steals MFA codes via WebOTP API, exfiltrates GPS and contacts, and acts as a browser RAT."
url: "https://hashnode.com/posts/fake-google-security-alert-installs-pwa-that-steals-mfa-codes/69a66ca45fe65b6733d5e32e"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [Fake Google Security Alert Installs PWA That Steals MFA Codes](https://deepseax.hashnode.dev/fake-google-security-alert-installs-pwa-that-steals-mfa-codes?utm_source=hashnode&utm_medium=feed)

A phishing campaign uses google-prism.com to install a fake Google security PWA that steals MFA codes via WebOTP API, exfiltrates GPS and contacts, and acts as a browser RAT.

Mar 3 · 4 min read · deepseax.hashnode.dev  
Read the article

-   [#browsersecurity](https://hashnode.com/tag/browsersecurity)
-   [#mfa](https://hashnode.com/tag/mfa)
-   [#phishing](https://hashnode.com/tag/phishing)
-   [#progressivewebapp](https://hashnode.com/tag/progressivewebapp)

## Written by

[DeepSeaX](https://hashnode.com/@deepseax)

@deepseax · thailand

  
[View profile](https://hashnode.com/@deepseax)

AI-Powered Penetration Testing | Creator of The Insider X

Building the future of cybersecurity with AI. Free pentest at theinsider-x.com

## Responses

Markdown supported · ⌘↵ to post

No responses yet.