One scam app even captures your QR codes. You don’t have to look very hard for it: The developer took out an App Store ad, which means it is prominently shown when you search for authenticator apps.