Fake Event Invites Are Stealing Google Credentials: What You Need to Know

Emily Davis · 2026-10-16

You get an email about a conference. It looks legit—maybe even from a colleague or a known research group. You click the link, and suddenly you're on a page that looks exactly like Google's login. But it's not. That's the trap UAT-11985 is setting, and it's working. Cybersecurity researchers have uncovered a sophisticated spear-phishing campaign by an advanced persistent threat (APT) group tracked as UAT-11985. This group is targeting individuals affiliated with Taiwan research organizations, but the tactics they use are a warning sign for professionals everywhere—especially those in the antidetect browser community who value privacy and security. ### How the Attack Works The campaign starts with a fake event invitation. It's designed to look like a legitimate invite to a conference, seminar, or networking event—something that would naturally interest researchers and professionals. Once you click, you're redirected to an adversary-in-the-middle (AitM) phishing framework. This isn't your average phishing page; it sits between you and the real Google login, capturing your credentials and even your multi-factor authentication (MFA) codes in real time. > "AitM attacks are particularly dangerous because they bypass traditional MFA. Even if you have 2FA enabled, the attacker can intercept the session token and gain access to your account." That means even the most security-conscious among us could fall victim if we're not paying close attention. ### Why Antidetect Browser Users Should Care If you're using an antidetect browser to manage multiple online identities, you're already aware of the importance of operational security. But this attack vector is a reminder that even the best tools can't protect you from every threat—especially social engineering. Here's what you can do: - **Verify event invitations**: Before clicking any link, confirm with the organizer through a separate channel. If it's unsolicited, be extra cautious. - **Check the URL**: AitM pages often have subtle differences in the URL. Look for typos or unusual domains. - **Use security keys**: Hardware-based MFA (like YubiKey) is more resistant to AitM attacks than SMS or app-based codes. - **Keep your antidetect browser updated**: Ensure you're running the latest version with all security patches. ### The Bigger Picture UAT-11985's campaign is a stark reminder that cyber threats are evolving. They're not just targeting large corporations; they're going after individuals—researchers, journalists, activists—anyone with valuable data or access. And they're using increasingly sophisticated methods to bypass our defenses. For those of us in the antidetect browser space, this underscores the need for a layered security approach. Your browser can help you manage multiple profiles and avoid tracking, but it's not a silver bullet. Combine it with good hygiene: strong, unique passwords, hardware MFA, and a healthy dose of skepticism. ### Stay Safe Out There The internet is a wonderful but wild place. Stay informed, stay cautious, and don't let a fake event invite ruin your day. If something feels off, it probably is. Trust your gut—and your security protocols. Remember, the best defense is a well-informed user. Share this with your team, and keep the conversation going. We're all in this together.