Cybercriminals are turning to Progressive Web Applications (PWAs) to infiltrate mobile devices and steal banking credentials. These web-based apps, which are designed to function like native applications, have been exploited to bypass security measures on both iOS and Android devices.

According to a new report by ESET Research, the attacks have targeted mobile banking users in the Czech Republic, Hungary, and Georgia. The malicious campaigns involve distributing links to fake banking apps through various channels, such as SMS messages, automated calls, and social media advertisements. Once the link is clicked, the user is taken to a fake Google Play or App Store page. Tapping “Install” on this page installs a phishing PWA onto the user’s device.

“This technique is noteworthy because it installs a phishing application from a third-party website without the user having to allow third-party app installation,” says Jakub Osmani, an analyst with ESET.

On Android, the phishing app even declares that it was sourced from the Google Play Store. This effectively deceives users into trusting the app.

Once installed, these malicious PWAs prompt users to log in to what they believe is their bank’s mobile app. Instead, their credentials are sent to the attackers’ command-and-control servers. ESET’s research notes that some of these servers have been operational since March 2024. In certain cases, the stolen data is even directly transmitted to the attackers on Telegram via bots.

The implications of these attacks are significant. Not only do they expose users to potential financial loss, but they also represent a broader threat to mobile security. As noted by BleepingComputer, the ability of PWAs to bypass traditional app store vetting processes and security prompts makes them an attractive tool for cybercriminals.

While the current wave of attacks has primarily focused on users in the Czech Republic, security experts warn that this method could easily spread to other regions as more threat actors adopt these techniques. The versatility of PWAs, combined with their ability to evade standard security measures, makes them a potent weapon in the hands of cybercriminals.