A phishing website posing as a Google security check is tricking people into installing malicious web app that steals login codes, and more.