A new phishing technique uses progressive web apps (PWAs) to mimic browser windows with convincing web addresses to steal passwords.