It gets worse: somebody has pushed what appears to be a malicious update to the FTX app, and the official FTX telegram channel is warning people not to even browse to the website!
The update box is clearly based on their pre existing popup used for things like 2FA.
Could this popup have been modified with new text and linked to a new malicious site without an app update on ios or android?
Or, could the popup only function if it was already coded into the app waiting to be activated? Meaning premeditated
You could also serve a change like this with an OTA update, again no app store review required, which ios and android allow (as long as you don't fundamentally change the app, and even then they could only catch that retroactively.
Not sure if they'd care if you load it in a webview as long as the UX wasn't substantially different. I seem to recall getting bounced to web auth flows pretty often.