Fake Event Invites Are Stealing Google Logins — Here's How

Emily Davis · 2026-10-16

Picture this: an invite lands in your inbox for a research symposium that sounds exactly like your world. It's polished, it's relevant, and it feels legitimate. That's the trap. Researchers have now pulled back the curtain on a spear-phishing campaign run by a group tracked as UAT-11985, and it's targeting people affiliated with Taiwan research organizations to steal their Google account credentials and multi-factor authentication (MFA) codes. This isn't a clumsy mass email blast. It's a focused, persistent operation — the kind that studies its targets before it strikes. ### How the Attack Actually Works The campaign leans on something called an adversary-in-the-middle (AitM) phishing framework. Instead of just faking a login page and hoping you type your password, the attackers sit between you and the real Google sign-in process. You log in, you enter your MFA code, and everything looks normal — because it is normal, on the surface. Behind the scenes, the framework captures your credentials and your one-time codes in real time. That's the scary part. MFA is supposed to be your safety net, and AitM attacks are built specifically to slip past it. The lure is the fake event invite. It gives the attacker a believable reason to send you a link, and it gives you a believable reason to click. Once you're on the page, the credential harvesting begins. ### Why Research Affiliates Are the Target Research organizations handle sensitive work, collaborate across borders, and often communicate heavily through Google services. That combination makes them valuable. A compromised inbox isn't just one stolen password — it can be a doorway into shared documents, colleague contacts, and ongoing projects. As someone tracking antidetect browser and digital privacy threats, I keep coming back to one point: attackers don't always need sophisticated malware. Sometimes they just need a convincing story and a moment of trust. > "The most dangerous phishing email isn't the one that looks fake. It's the one that looks like it was written just for you." ### What You Can Do About It You don't need to become a security analyst to protect yourself. A few habits go a long way: - Treat unexpected event invites with suspicion, especially ones asking you to log in through a link. - Type the destination address yourself instead of clicking through from an email. - Prefer phishing-resistant authentication methods like hardware security keys over SMS or app codes. - Watch for subtle domain misspellings — one swapped letter is often the whole trick. - Report suspicious messages to your IT or security team so others get warned too. ### The Bigger Picture AitM phishing is a reminder that credential theft keeps evolving. The tools get better, the fake pages get cleaner, and the social engineering gets sharper. Defense has to keep pace — and that starts with awareness. If you work with research data, shared drives, or Google Workspace, take a second look at your login flow this week. Ask yourself: would I notice if a sign-in page wasn't quite right? That single question might be the difference between a close call and a real breach.