[api]

How can revoking apps stop a phishing attack?

[zepto]

Easy: Revoke the certificate of the app doing the phishing.

[judge2020]

To add, this is exactly what google's safe browsing is https://safebrowsing.google.com/