How PWA Technology Can Steal Banking Login
Credentials from iOS and Android Phones

Author – Andrew Smith
August 2024

How PWA Technology Can Steal Banking Login Credentials from iOS and Android Phones

Introduction to Progressive Web Applications (PWAs)
Progressive Web Applications (PWAs) represent a significant advancement in web technology,
seamlessly blending the accessibility of web pages with the functionality of native mobile
applications. At their core, PWAs leverage standard web technologies such as HTML, CSS, andJavaScript to deliver user experiences that are fast, reliable, and engaging.
One of the standout features of PWAs is their offline capabilities. Utilizing service workers, which
act as proxy servers between the network and the device, PWAs can cache resources and ensure
continuous functionality even when offline. This makes them particularly appealing to users inregions with inconsistent internet connectivity.
PWA technology also promotes responsive design, ensuring that applications work well on anydevice, from desktop computers to mobile phones. This adaptability is pivotal in an era whereusers access content across a wide range of screen sizes and resolutions.
Another major advantage is the ease of installation. Unlike traditional native apps, which require
downloading from app stores, PWAs can be added directly from a web browser. Users can save
PWAs to their home screen with just a few taps, reducing friction and increasing adoption rates.
Additionally, PWAs support push notifications, allowing businesses to re-engage users withtimely updates and personalized content.
The popularity of PWAs is on the rise, driven by these compelling features and the potential forcost savings. Developing a single PWA instead of multiple platform-specific apps (iOS andAndroid) can significantly reduce development and maintenance costs for businesses.
Furthermore, PWAs often offer improved performance and user satisfaction, leading toincreased engagement and customer retention.
In simpler terms, PWAs work by employing service workers, which manage the caching ofresources and handle network requests. This ensures that content is delivered swiftly andreliably. The combination of these elements forms the foundation of PWAs, transforming theminto a formidable alternative to traditional mobile applications.
Security Concerns Associated with PWAs
Progressive Web Applications (PWAs) bring forward a blend of web and mobile applicationfeatures, promising accessibility and functionality. However, as their adoption increases, so do
the associated security concerns. While PWAs are designed to offer a secure environment,
certain vulnerabilities can still be exploited by malicious entities to steal sensitive information,
including banking login credentials from iOS and Android devices.
One prominent risk is the creation of fake PWAs. Cybercriminals can develop PWAs that mimic
the appearance of legitimate banking applications, misleading users into entering theircredentials on these fraudulent platforms. Once the information is entered, it is siphoned off toremote servers controlled by the attackers, compromising users' financial data.
A familiar security threat often encountered in the realm of PWAs is cross-site scripting (XSS). In
an XSS attack, an adversary injects malicious scripts into a legitimate PWA, which then executeson the user's device. These scripts can capture keystrokes, steal cookies, or redirect users tophishing websites, making them particularly dangerous.

Copyright©2024 ICMS Cyber Solution Co., Ltd.

Page 1 of 3

How PWA Technology Can Steal Banking Login Credentials from iOS and Android Phones

Man-in-the-middle (MitM) attacks also pose a significant hazard. Since PWAs often rely on web
technologies and internet connectivity, they are exposed to interception and tampering of dataexchanges. An attacker can intercept the communication between the PWA and the server,
gaining unauthorized access to sensitive information such as login credentials, personal data,and financial details.
Insecure data storage is another critical issue. PWAs may store data locally on the device toenhance user experience and performance. However, if this data is not properly encrypted orsecured, it becomes an easy target for attackers. Accessing unprotected data storage can leadto unauthorized retrieval of sensitive information, compromising user privacy and security.
In light of these threats, it is imperative for developers to implement robust security measures,and for users to remain vigilant when engaging with PWAs, particularly those related to financialtransactions. Understanding these risks and taking appropriate precautions can significantly
mitigate the potential for cybercriminal activities targeting PWA technology.
How PWAs Steal Banking Login Credentials
Progressive Web Applications (PWAs) have revolutionized how users interact with web content,
but they also pose significant security risks, especially regarding banking login credentials. Amalicious PWA can be designed and distributed through various deceptive means, making
unsuspecting users easy targets. The process typically begins through phishing attacks, whereusers receive seemingly legitimate communications—often through email or text—encouraging
them to install a PWA for better banking experience or improved security features.
Once users are convinced to install the malicious PWA, several mechanisms come into play tocapture sensitive information. A common method involves creating fake login screens thatclosely resemble the legitimate banking app or website. These screens prompt users to input
their credentials, which are then intercepted and transmitted to the attackers. The sophisticationof these fake screens makes them nearly indistinguishable from authentic ones, leading to a highsuccess rate in credential theft.
Another method malicious PWAs employ is keylogging. Integrated keylogging capabilities canrecord every keystroke made by the user within the PWA. This data includes usernames,
passwords, account numbers, and even security questions and answers. The captured
keystrokes are then sent to the attackers in real-time or at set intervals, providing them with
continual access to fresh login information.
The ease with which users can be tricked into installing these malicious PWAs is alarming. Often,these apps are distributed through unofficial app stores or third-party websites, and sometimes
even infiltrate official app stores due to their initial harmless appearance and functionality. Once
installed, the PWA can request permissions that seem appropriate for a banking application,such as access to network connectivity, which further aids in the transmission of stolen data.
The risk is evident in real-life examples where malicious PWAs have duped users. In one notablescenario, a fake banking PWA disguised as a reputable financial institution's app wasdownloaded thousands of times before being detected. While specific outcomes vary, theunderlying threat remains clear: users must exercise extreme caution when installing any PWA,
particularly those related to sensitive functions like banking.

Copyright©2024 ICMS Cyber Solution Co., Ltd.

Page 2 of 3

How PWA Technology Can Steal Banking Login Credentials from iOS and Android Phones

Protecting Yourself Against PWA Security Threats
As Progressive Web Apps (PWAs) become increasingly popular, understanding how to protect
yourself from potential security threats is crucial. One practical approach is to scrutinize thesource of any PWA before installation. This can be done by downloading apps exclusively fromtrusted repositories such as the Google Play Store or Apple App Store, where rigorous security
checks minimize the risk of encountering malicious applications.
Reading user reviews and ratings can also help identify fake or suspicious PWAs. Authenticreviews often highlight the app's legitimacy or raise flags about potential issues. Equallyimportant is verifying the permissions requested by the app. While some permissions arenecessary for functionality, excessive or unrelated requests should be treated with caution. For
instance, an app claiming to be a simple calculator should not require access to your contacts
or messages.
Keeping your devices updated with the latest software patches is another essential measure.
Manufacturers often release security updates to address vulnerabilities, and staying current
reduces the risk of exploitation by malicious PWAs. Coupled with this is the importance of using
reputable antivirus software, which can provide an additional layer of protection by scanning for
and alerting you to potential threats.
Moreover, be mindful of the information you share on mobile apps. Sensitive data such as
banking credentials, personal identification numbers, and other critical information should behandled with the utmost care. Limiting the amount of personal information shared reduces thepotential impact should a security breach occur.
Organizations and developers also play a critical role in safeguarding their PWAs. Adhering tobest practices for security, such as employing robust encryption, conducting regular securityaudits, and keeping abreast of the latest threats, can dramatically reduce vulnerabilities.
Educating customers on how to use PWAs safely, through clear communication and user guides,
helps foster a more secure environment for all.
By taking these precautionary steps and maintaining vigilance, both users and developers cansignificantly mitigate the security risks associated with PWAs, ensuring a safer digital experience.

Copyright©2024 ICMS Cyber Solution Co., Ltd.

Page 3 of 3