This Phishing Campaign Hijacks Google Events to Steal Research Credentials

Robert Moore · 2026-10-16

Imagine getting an email that looks exactly like a Google Calendar invite from a colleague. You click, expecting to see a meeting agenda. Instead, you're redirected to a fake Google login page that steals your password and even your two-factor code. That's the reality of a new spear-phishing campaign targeting researchers in Taiwan. Security researchers have uncovered an advanced persistent threat (APT) group—tracked as UAT-11985—using this clever trick to compromise Google accounts. The victims? Individuals affiliated with Taiwan research organizations. The goal? Harvesting credentials and MFA codes through an adversary-in-the-middle (AitM) phishing framework. ### How the Attack Works The attack starts with a legitimate-looking event invite. Once you click, you're sent to a phishing page that mimics Google's login. But here's the twist: the page uses an AitM proxy to intercept everything you type—including your username, password, and the one-time code from your authenticator app or SMS. The attackers then relay that information to Google in real-time, bypassing MFA entirely. This isn't your typical phishing scam. AitM attacks are sophisticated because they don't just steal static credentials; they capture session tokens, allowing attackers to hijack active sessions. And because the phishing page is served from a legitimate-looking domain, even savvy users can be fooled. ### Why Taiwan Research Organizations? Taiwan is a hotspot for geopolitical cyber-espionage, particularly in sectors like technology, defense, and academia. Research organizations often hold valuable intellectual property and sensitive data. By targeting affiliates, attackers can pivot into larger networks or steal research findings. The use of fake event invites is particularly sneaky. People are conditioned to trust calendar invites from known contacts. And in a research setting, collaboration is constant—so an invite to a "conference" or "project meeting" seems normal. ### What This Means for You Even if you're not in Taiwan, this campaign offers lessons for everyone: - **Verify unexpected invites:** If you get a calendar invite you weren't expecting, confirm with the sender through another channel (like a phone call) before clicking. - **Check the URL:** Before entering credentials, ensure the page is on the correct domain (e.g., accounts.google.com). Phishing pages often use lookalike domains. - **Enable MFA—but know its limits:** MFA is crucial, but AitM attacks can bypass it. Consider using hardware security keys or passkeys for stronger protection. - **Stay informed:** Follow threat intelligence reports to understand emerging tactics. > "The sophistication of AitM phishing means that even the most cautious users can be caught off guard. It's not about being paranoid—it's about being prepared." ### The Bigger Picture UAT-11985's campaign is a reminder that cyber-espionage is evolving. Attackers are combining social engineering with technical exploits to bypass traditional defenses. For organizations, especially in research and academia, investing in advanced threat detection and user education is no longer optional. And for individuals? Stay skeptical. That invite might look legitimate, but a quick pause could save your account—and your organization's data.