AISEC > Security News > Phishing > Fake Google Security PWA Steals MFA Codes, Credentials
March 02, 2026 #phishing Source: BleepingComputer 3 min read · 605 words

Fake Google Security site uses PWA app to steal credentials, MFA codes

Підроблений сайт безпеки Google використовує PWA для крадіжки облікових даних та кодів MFA

Timeline: When the Campaign Started

The phishing campaign was first documented by BleepingComputer in early March 2026, though security researchers suggest the operation may have been running undetected for weeks prior. The attackers had already compromised an unknown number of victims before the discovery. That matters because every day the campaign stays active, more people fall for it.

And the sophistication level? It's alarming.

The Discovery

Security researchers uncovered the attack while investigating reports of credential theft targeting Google Account users. What initially looked like a standard phishing page revealed something far more dangerous on closer inspection. The attackers weren't just harvesting login information—they'd built a full-featured malware delivery system disguised as a legitimate security check.

The fake Google Account security page itself was convincing. It mimicked Google's actual interface well enough that most users wouldn't catch the deception in a moment of panic. But here's where it gets nasty: the page prompted victims to install what appeared to be a security app. In reality, it was a progressive web app (PWA) with capabilities well beyond what a typical PWA should possess.

Is PWA safe? That's the question this attack forces us to ask. Progressive web apps live in a murky space—they're apps but not apps, websites but not websites. The technology itself isn't inherently dangerous, but it's revealing serious blind spots in how users and even organizations understand security boundaries.

Technical Analysis

Once installed, the PWA became a complete remote access tool. It harvested login credentials. It captured multi-factor authentication codes in real time—defeating the very security measure that's supposed to prevent unauthorized account access. The real question is: if MFA authentication issues allow codes to be intercepted this easily, how many other attack vectors are we missing?

But it didn't stop there.

The malware also scraped cryptocurrency wallet addresses and recovery phrases. It monitored clipboard content. Most troubling: it converted victims' browsers into proxy servers, allowing the attackers to conduct their own web traffic through compromised machines. That's six months of potential reconnaissance or lateral movement attacks without the victim ever knowing.

The lack of MFA vulnerability here isn't a flaw in the MFA system itself—it's that the attacker got upstream of it. They captured the code before the user could input it. This highlights why can MFA be hacked remains a legitimate question in security circles. It can't be, in isolation. But combined with credential theft, it becomes useless.

Damage Assessment

BleepingComputer hasn't published confirmed victim numbers, but the fact that the campaign remained active long enough to be discovered suggests the infection rate was significant enough to warrant research attention. We're talking potentially hundreds of compromised accounts.

The exposure extends beyond Google accounts themselves. Cryptocurrency holdings are at direct risk. Corporate networks are at risk if any victims used work email addresses. And those victims' browsers? They're now compromised surveillance tools.

The scope of potential damage depends entirely on victim profile. A regular user loses cryptocurrency and money. An employee at a Fortune 500 company becomes an unwitting insider threat.

Mitigation

First action: if you visited what you thought was a Google security page and installed an app, assume compromise. Change your Google password immediately from a clean device. Enable security key-based MFA if you haven't already—physical security keys are harder to intercept than app-based codes. Review your Google account recovery options and remove any unauthorized phone numbers or recovery emails.

For organizations: audit your MFA cyber security implementation. Does your MFA cyber security meaning include endpoint monitoring? If not, it should. Update security awareness training to specifically address PWA-based attacks. Block installation of PWAs from non-enterprise sources if possible.

And frankly? It's time to reconsider whether time-based MFA codes should still be considered sufficient protection in 2026. They're not.

Read original article →

// FAQ

How do I know if I installed the malicious PWA?

Check your browser's installed app list and recent app installation history. If you visited a Google security page in the last few weeks and installed anything, assume compromise and change your passwords immediately from a different device.

Does this attack bypass MFA or steal MFA codes?

It steals MFA codes before you can use them. The PWA intercepts the code in real time, meaning even if MFA is enabled, the attacker can authenticate as you. This is an upstream attack, not a flaw in MFA itself.

Can my browser being used as a proxy expose my company network?

Yes. If you use the same browser for work and personal accounts, attackers can use your machine to probe corporate systems, access internal resources, or launch attacks appearing to originate from your IP address. Report this immediately to your IT security team.

// RELATED

#phishing SLH Offers $500–$1,000 Per Call to Recruit Women for IT Help Desk Vishing Attacks 2026-02-25 #phishing ‘Starkiller’ Phishing Service Proxies Real Login Pages, MFA 2026-02-20

Concerned about your project's security? Run an automated pentest with AISEC — fully automated AI-powered scanner. Go to dashboard →