Recent research has uncovered an elaborate phishing campaign targeting European banking customers, leveraging Progressive Web Applications (PWAs) to steal user credentials. Beginning in November of 2023, and as recently as May 2024, the campaign involved hackers setting up malicious banking applications that closely mimic legitimate ones, tricking users into installing these apps on their Android and iOS devices through third-party websites. This method bypasses traditional security measures that usually alert users to the installation of unknown programs. The campaign used automated voice calls, SMS messages, and social media advertisements to lure victims. These tactics directed users to high-quality phishing pages where they were deceived into downloading fake banking apps. The campaign has primarily targeted users of prominent banks in the Czech Republic, Hungary, and Georgia, including a major Czech bank, OTP Bank, and TBC Bank. The PWAs used in these attacks are essentially websites packaged to function like standalone applications, making them difficult for operating systems to detect as harmful. Once installed, these apps prompted users to enter their banking credentials, which were then sent to the attackers’ servers. Researchers were able to coordinate the takedown of multiple phishing domains and attacker-controlled servers, sharing sensitive information with the affected banks for further processing. A detailed analysis of the command-and-control (C2) servers and the back-end infrastructure revealed the involvement of two (2) distinct threat actors employing different infrastructures. In response to the rise of PWA-based phishing attacks, cybersecurity experts emphasize the need for increased vigilance and the implementation of stronger defenses by platform providers like Google and Apple. The ability of PWAs to closely mimic native apps and bypass traditional security measures makes them a potent tool for cybercriminals, necessitating ongoing efforts to counteract these sophisticated phishing tactics.