Fake Event Invites Are Stealing Google Credentials—Here's How

Emily Davis · 2026-10-16

You get an email about a conference. Looks legit. Maybe it's from a research org you know. You click, and suddenly you're on a page that looks exactly like Google's login. But it's not. That's the reality of a new spear-phishing campaign that's been making the rounds, and it's a wake-up call for anyone who thinks they're too smart to fall for a phishing scam. Security researchers have uncovered an advanced persistent threat (APT) group—tracked as UAT-11985—that's targeting individuals affiliated with Taiwan research organizations. The goal? To steal Google account credentials and multi-factor authentication (MFA) codes using a sneaky technique called adversary-in-the-middle (AitM) phishing. ### What Is AitM Phishing and Why Is It So Dangerous? AitM phishing is like a man-in-the-middle attack, but for your login session. The attacker sets up a proxy server between you and the real Google login page. When you enter your credentials, they pass through the attacker's server, which captures everything—including your password and the MFA code you enter. Then, the attacker can use that information to log in as you, bypassing MFA because they've already got the code. What makes this campaign particularly nasty is the use of fake event invites. The attackers send personalized emails that look like invitations to conferences, seminars, or research meetings. These emails often include links to what appear to be legitimate event registration pages. But once you click, you're redirected to the AitM phishing page. ### How to Spot a Fake Event Invite So how do you protect yourself? Here are some red flags to watch for: - **Unsolicited invites:** If you weren't expecting an invitation, be skeptical. Especially if it's from someone you don't know or an organization you haven't interacted with. - **Urgency:** Phishing emails often create a sense of urgency—"Register now, limited spots!"—to make you act without thinking. - **Suspicious links:** Hover over links before clicking. If the URL doesn't match the official event website, don't click. - **Generic greetings:** Legitimate invites usually address you by name. If it says "Dear Researcher," that's a red flag. - **Poor grammar or spelling:** While attackers are getting better, many phishing emails still have telltale errors. ### The Role of Antidetect Browsers in Protection You might be wondering what antidetect browsers have to do with all this. Well, antidetect browsers are designed to mask your online fingerprint, making it harder for attackers to track you across sites. But they also offer features like isolated browsing profiles, which can prevent session hijacking. If you're someone who handles sensitive information—like research data—using an antidetect browser can add an extra layer of security. However, no tool is foolproof. The best defense is awareness and caution. Always verify the sender, check the URL, and never enter your credentials on a page you didn't navigate to directly. ### What This Means for You If you're affiliated with a research organization—or any organization, really—this campaign is a reminder that cybercriminals are getting more sophisticated. They're not just sending generic spam; they're crafting personalized attacks that exploit trust. > "The best defense against phishing is a healthy dose of skepticism. If something feels off, it probably is." Stay safe out there. And next time you get an event invite, take a second look before you click. ### Final Thoughts UAT-11985's campaign is a classic example of how APTs evolve. They adapt, they find new angles, and they exploit human psychology. By staying informed and using tools like antidetect browsers wisely, you can reduce your risk. But ultimately, your vigilance is your strongest shield.