In his article mr.d0x explores how attackers can exploit Progressive Web Apps (PWAs) for phishing purposes. The attacker creates a malicious PWA designed to mimic a legitimate application, such as “Microsoft Login”. Upon installation, the PWA redirects the user to a phishing page with a counterfeit URL bar. It is no lab curiosity either: ESET Research documented campaigns that lured customers of Czech banks into installing fake banking PWAs (WebAPKs on Android) via SMS, automated calls and social media ads, sidestepping the usual warning about installing apps from unknown sources.
