There's a new version of the "Cerberus" Trojan horse for Andoid phone which is now able to steal your one-time codes from Google Auth. App.
Stay alert.

[...]

Source here: https://www.zdnet.com/article/android-malware-can-steal-google-authenticator-2fa-codes/