One scam app even captures your QR codes. You don’t have to look very hard for it: The developer took out an App Store ad, which means it is prominently shown when you search for authenticator apps.

Google Authenticator first launched in 2010, and the app—which stores and generates two-factor authentication (2FA) codes—lacked backups and multi-device support for years.