Maybe... just maybe.. a simple answer is that your friend has a malware on his phone, and the "victim" isn't actually you but him.
I'd suggest you let him know he should comb through his installed apps/plugins, ask if he's installed anything sketchy lately, especially if it reoccurs.
If you still have service to your phone, it's unlikely to be a SIM swap attack. Generally, one of the consequences of a SIM swap is that all the services provisioned on your phone (including your phone number) are transferred to the attacker's phone, by the exact same process as those services would be transferred to your new phone when you upgrade. This is ...
its so easy the emkei works like this
the scriptor Ccvx catches the from field apply phonixcloper 12 to duplicate the originality and fill it with metaphoric_6.85 series to bypass any blacklist then harden it with usipo core for real time stamp and bounce it via xenopyro and deliver it with patakopo
i this way its easy and simple to spoof email with any ...
You cannot know if the app intercepts your credentials even if you are directed to the real Google account website.
That is precisely the reason Google stops supporting this.
Because we can’t differentiate between a legitimate sign in and a MITM
attack on these platforms, we will be blocking sign-ins from embedded
browser frameworks starting in June (...