Fake invites, real theft: AitM phish steals Google MFA

Attackers are dressing up as event hosts to steal Google logins—and even the MFA codes. Researchers told The Hacker News that an APT they track as UAT‑11985 is sending fake invites to people tied to Taiwan research groups, then using an adversary‑in‑the‑middle (AitM) setup to capture everything needed for account takeover.

What happened

The Hacker News reports that UAT‑11985 has been spear‑phishing individuals affiliated with Taiwan research organizations with polished event invitations that redirect to an AitM phishing framework. That framework sits between the victim and Google’s real login pages to intercept credentials as well as the multi‑factor authentication (MFA) codes prompted during sign‑in.

According to the researchers cited, the lures look like normal calendar or meeting emails but funnel clicks into a proxied flow. Because the AitM proxy relays the victim’s input to Google in real time, it can pluck out the one‑time code or verification prompt response alongside the username and password, enabling the attacker to establish a valid session.

The campaign’s targeting, per the report, is narrow: individuals linked to Taiwan research outfits. That scope suggests reconnaissance and selective delivery rather than broad spray‑and‑pray phishing, consistent with advanced persistent threat (APT) operators who value persistence and data access over volume.

The use of event invitations is strategic because many organizations treat calendar content as routine and trustworthy. The Hacker News notes that the attackers relied on the social credibility of a meeting ask to entice clicks, raising the chance that recipients engage quickly and on mobile, where full URLs and warning signs are harder to check.

The AitM framework highlighted by researchers is designed specifically to defeat MFA protections on Google accounts. By brokering the entire login exchange, the kit harvests both primary credentials and the time‑bound second factor, letting attackers create or hijack a live authenticated session without needing to persistently crack MFA afterwards.

The researchers’ write‑up indicates the campaign’s objective was credential harvesting and session theft for Google services, not malware delivery. That distinction matters for defenders who still anchor their controls around attachments and payloads rather than session integrity and identity abuse.

The report describes the activity as tracked under the designation UAT‑11985, a label that places it in a catalog of distinct threat operations. While the story does not name a country of origin or sponsor, the APT classification signals sustained capability and resources behind the phishing effort.

Because the credential theft targets Google accounts, the downstream risk extends beyond Gmail into Drive, Docs, Calendar, and any third‑party apps federated to the same identity. A captured session could expose research data, collaboration threads, and shared documents tied to targeted organizations.

The lure choice reflects a phishing trend that Email Vox has tracked in other contexts: attackers using legitimate‑looking collaborative asks to draw victims in. Our earlier report on North Korea’s research‑themed reply‑bait showed how credible invitations and research queries can disarm well‑trained recipients by appealing to their day jobs.

AitM phishing complicates traditional MFA guidance because it does not “break” the second factor; it sidesteps it. That nuance reinforces why phishing‑resistant methods like hardware‑backed FIDO2 passkeys are increasingly recommended for high‑risk roles, though the article focuses on the AitM kit’s capabilities rather than countermeasures.

The report underscores that email alone isn’t the perimeter. Calendar systems, invite flows, and linked web apps become part of the social‑engineering surface. Email teams who tuned filters primarily for attachments and obvious credential pages may miss a proxied flow that looks like Google to automated checks.

The Hacker News notes the combination of targeted lures and an AitM stack as the core technique. This differs from commodity phish kits that simply clone a login page; by mediating the full exchange, UAT‑11985 captures transient MFA artifacts that less sophisticated kits never see.

The campaign’s focus on Taiwan research circles places it in a sensitive geopolitical context. While attribution is not provided in the report, credential access to academic or policy researchers can yield insight into projects, partners, and timelines, which makes such targets attractive to state‑aligned operators.

Email security vendors have increasingly warned about identity‑centric attacks that rely on trusted UX flows. We’ve covered how attackers bait AI email assistants with hidden prompts—a different technique with the same aim: turn helpful features into footholds. The UAT‑11985 campaign does it with invites and proxied sign‑ins.

For organizations using Google Workspace, the risk is magnified when users reuse sessions across services. A captured session can unlock files in Drive or expose meeting metadata in Calendar without any malware ever touching the endpoint, complicating incident detection and response.

The story’s emphasis on MFA capture should prompt a review of how login challenges are presented and verified. When a user responds to a prompt relayed through an AitM proxy, the back‑end sees a normal flow. Without additional signals—like device keys or bound tokens—it’s hard to distinguish.

In previous coverage of infrastructure disruption, we noted how coalitions have tried to dismantle phishing back‑ends. The UAT‑11985 case reinforces that even when infrastructure is hit, attackers can spin up new proxies quickly, especially if the lure continues to perform.

On the mail‑flow side, DMARC (Domain‑based Message Authentication, Reporting and Conformance) can reduce spoofing risk for official event‑sending domains, but it doesn’t stop links to off‑domain proxies. As we’ve written in our guide to BIMI’s DMARC foundation, authentication is necessary—but not sufficient—when the social engineering is convincing.

For defenders, the operational takeaway is to watch for anomalous Google sign‑ins that coincide with invite‑click timestamps. Because the attacker relays the session live, login patterns may show atypical IP geographies or headers immediately after an invite is opened and a link is clicked.

Finally, the report highlights why calendar invites deserve the same scrutiny as invoices and shipping notices. Attackers go where attention flows. In research organizations that thrive on collaboration, an invite that looks relevant is an efficient compromise path.

The background

The Hacker News frames this as an APT spear‑phishing effort with AitM capability rather than a mass phishing wave. That places it among campaigns engineered for smaller target pools but higher per‑victim yield, a pattern seen in operations that value access to institutional accounts over quick fraud.

Google accounts are a prime target because one identity spans email, documents, meetings, and often third‑party apps. Capturing both a password and an MFA response via AitM gives attackers a short window to establish a foothold, sometimes long enough to set recovery options or app passwords.

While the article centers on UAT‑11985, its TTPs align with a broader industry warning that MFA alone—especially code‑based—won’t stop modern phishing. The differentiator here is the lure: fake event invites that exploit work‑as‑usual expectations in research settings.

The AitM approach also allows attackers to bypass many secure email gateway checks because the initial email can be clean of attachments and hosted on otherwise benign infrastructure. The maliciousness lives in the proxied flow after the click, which perimeter email tools may not see.

In our coverage of email defenses shifting toward intent, vendors argued for correlating inbox behavior with web flows. Campaigns like UAT‑11985 exemplify why: the decisive harm occurs in the browser session that the email initiates, not in the message payload itself.

What people are saying

The Hacker News attributes its details to cybersecurity researchers who analyzed the campaign and identified the AitM framework used to harvest both Google credentials and MFA codes. Their assessment characterizes the activity as APT‑level spear‑phishing and notes the Taiwan research focus.

The report’s framing implies defenders should reconsider how they validate Google logins initiated from email clicks. Researchers emphasize that AitM can neutralize code‑based MFA by capturing it in transit, suggesting a need for phishing‑resistant factors and tighter session controls.

Given the research‑sector targeting, security teams in academia and think tanks are likely to prioritize awareness around invite‑based lures. The article’s focus on Google accounts directs attention to Workspace administrators who can tighten policies on external invites and session lifetime.

What happens next

The next steps for targets are straightforward: verify recent invite‑driven sign‑ins to Google accounts, review session logs for anomalies, and rotate credentials where suspicious sequences are found. Organizations tied to Taiwan research networks should prioritize monitoring due to the campaign’s stated focus.

Expect more invite‑themed lures while they continue to work. Attackers iterating on AitM flows need only adjust the veneer—a different conference name or organizer—while keeping the proxy core intact. Defenders can blunt impact by shrinking session windows and requiring phishing‑resistant authentication for sensitive access.

On the ecosystem side, email and calendar platforms will likely keep nudging admins toward stronger defaults for external invites. Incremental controls—warning banners, link isolation, and restricted auto‑add—can reduce the reflexive clicks that AitM campaigns convert into stolen sessions.

For broader coverage of security stories like this, see our security hub at /category/security, and track related developments—from takedowns to tooling shifts—across our recent reports linked above.