Hackers don't need an app to steal login credentials anymore - a PWA will do.