Check Academic Invitations: Live Phishing Kit Bypasses Google MFA

Cisco Talos researchers have identified a sophisticated phishing operation, tracked as UAT-11985, that steals Google account sessions from researchers in Taiwan. The campaign, detailed in an October 8 threat report, uses live WebSocket connections to mirror authentication steps. This technique allows attackers to bypass multi-factor authentication by relaying login requests in real time rather than cracking security checks.

How does the phishing kit bypass multi-factor authentication?

The attack relies on an operator-driven system that combines standard HTTP requests with WebSocket updates. When a victim interacts with the fake sign-in page, the kit mirrors Google’s actual authentication process. This setup lets attackers guide users through each security step, including multi-factor prompts, by forwarding the requests to the legitimate service and passing the responses back to the victim.

According to Cyber Security News, this approach differs from basic credential harvesting. Instead of collecting static passwords, the system maintains an active session. The attacker controls the flow, ensuring that the victim completes the verification process while the attacker simultaneously gains access. This real-time relay method effectively sidesteps the protection offered by two-factor authentication codes.

Who are the targets and what do the emails look like?

The operation specifically targets individuals linked to research organisations in Taiwan. Emails in the campaign pose as invitations to academic and policy events. They use real event details alongside false sender identities and hidden registration links to appear as routine professional correspondence. This tactic aims to make the credential theft attempt look like legitimate administrative communication.

The messages impersonate the Taiwan European Union Centre, the NCCU Institute of International Relations, and the Taiwan Research Institute. When recipients verified the senders with these institutions, none could confirm the individuals were employees. The attackers used accurate event information to build trust around these fabricated identities, making the deception more convincing to busy academics.

What evidence suggests artificial intelligence involvement?

Each message followed a similar pattern, featuring a policy-themed opening, tailored praise for the recipient, and registration instructions. Talos noted signs of AI-assisted writing, such as repeated sentence patterns and broad compliments. The emails showed quick changes to suit different topics and recipients, suggesting a template-driven approach.

However, researchers could not prove that a large language model wrote the complete emails. The findings support the likelihood of AI assistance rather than confirmed fully automated content generation. The attackers also copied legitimate event posters and replaced their QR codes with malicious ones. This suggests printed materials could expose additional people who never received the original email, meaning a familiar design offers no assurance of safety.

What are the next steps for detection?

Talos tracked this activity during mid-2026 and published their detailed analysis on 8 October. The report highlights how the kit lets an operator control each authentication stage. Victims first encounter a fake Google Form that redirects them to a copied sign-in page. This structure is similar to the session theft risks seen in previous Tycoon 2FA phishing attacks, where a convincing page sits between users and the real service.

No patch or fix has been confirmed yet for the underlying technique, as it relies on user interaction with fake sites rather than a software vulnerability. The focus remains on identifying the malicious infrastructure and warning potential targets. The use of live relays makes traditional static analysis less effective, requiring behavioural monitoring to detect the real-time data exchange between the victim and the attacker.

What to do and how to stay safe: Cisco Talos

• Verify unexpected event invitations by contacting the organising institution through official, known channels, not links in the email.
• Check for AI-generated text patterns in personalised emails, such as generic praise or repetitive sentence structures.
• Scan QR codes from printed materials using a separate device or service before accessing any linked content.
• Monitor account activity for unrecognised sessions, especially after interacting with unfamiliar registration forms.

Step-by-step guide: Is It Safe to Use Password Managers? The Real Risks and Rewards

General security guidance from the DarkWeb Dispatch newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does this attack steal my password directly?

No, the kit mirrors the entire authentication process in real time, allowing the attacker to steal an active session rather than just static credentials.

Which organisations were impersonated in this campaign?

The attackers impersonated the Taiwan European Union Centre, NCCU Institute of International Relations, and the Taiwan Research Institute.

Is there a software update to fix this vulnerability?

No fix has been confirmed yet, as the attack exploits user interaction with phishing sites rather than a technical flaw in Google’s code.