New phishing attack on Android and iOS users using PWA and WebAPK: how to protect yourself?

A new type of phishing attack has been discovered that targets Android and iOS users. This attack uses traditional social engineering techniques along with Progressive Web Applications (PWA) and WebAPK, making it a serious threat to mobile users.

The attack was first identified in November 2023, and since then several cases have been reported, mainly among Czech bank clients. However, cases have also been recorded in Hungary and Georgia, indicating wider coverage.

The page checks whether a mobile device is in use and, if so, prompts you to install the application through a pop-up window. The phishing app you install can be a PWA or WebAPK, allowing it to run on multiple platforms and devices. PWAs are essentially websites packaged into a standalone application that can be launched from a menu or home screen.

WebAPKs are an advanced version of PWAs created by the Chrome browser as a native Android application. The installed phishing application is almost indistinguishable from a real banking application, with the same logo and design. Upon opening the application, the victim will see a fake login page where they will be asked to enter their online banking information. The entered information is sent to the attackers servers.

The attackers C&C (Command and Control) infrastructure is quite complex, with two different groups running the phishing campaigns. One group uses a Telegram bot to log all entered information into a Telegram group chat via the official API, while the other uses a traditional C&C server with an admin panel.

Attackers evade detection by using multiple domains and preparing new malicious campaigns. According to ESET researchers, some of the C&C servers have been deactivated and the affected banks have been notified.

To protect yourself from this type of phishing attack, it is important to be careful when installing new applications, especially those that ask for sensitive information. Always check the authenticity of the application and the site from which it is downloaded. Also, keep your device and browser up to date by installing the latest security updates.

This new type of phishing attack poses a serious threat to Android and iOS users. By combining traditional social engineering methods with the use of PWA and WebAPK, attackers have created a dangerous tool for deception.