New Phishing Technique Bypasses Security on iOS and Android to Steal Bank Creds

A new phishing technique has emerged that targets users of iOS and Android devices, utilizing Progressive Web Applications (PWAs) and WebAPKs to steal banking credentials. ESET, an anti-malware vendor, has reported that cybercriminals are creating web applications that mimic legitimate banking software, allowing them to bypass security measures. On iOS, users are prompted to add the PWA to their home screens, while Android users confirm pop-ups to install the application, which appears to be from Google Play. These malicious applications do not trigger security warnings, making them difficult to detect. Once installed, users are directed to a phishing login page where they are asked to enter their banking credentials, which are then sent to the attackers' command-and-control servers. The attacks, which began around November 2023, have primarily targeted mobile banking users in the Czech Republic, with additional incidents reported in Hungary and Georgia. ESET has identified two different threat actors using this tactic and warns that the phishing campaigns may expand with more deceptive applications.

- New phishing technique targets iOS and Android users through PWAs and WebAPKs.

- Malicious applications mimic legitimate banking software, bypassing security measures.

- Users are tricked into installing these apps without security warnings.

- Attacks primarily focus on mobile banking users in the Czech Republic, Hungary, and Georgia.

- ESET warns of potential expansion of these phishing tactics by threat actors.