A convincing fake Google Account security page is being used as the front end for a surprisingly sophisticated browser-based surveillance toolkit that can convert an installed Progressive Web App (PWA) into a persistent command-and-control (C2) channel, steal one-time passcodes and clipboard...