A fake Google security site installs a malicious PWA that steals OTPs, crypto wallets, and location data. Here’s how the ...