Hackers Use AI-Generated Event Lures to Steal Google Accounts and Bypass MFA

An advanced persistent spear-phishing campaign (tracked as UAT-11985) targeted Taiwanese research organizations using credible, likely AI-assisted event invitations, spoofed Google Forms and posters with altered QR codes to direct victims to attacker-controlled sites; an operator-driven WebSocket relay synchronized with Google’s authentication flow to capture credentials, MFA responses, and session tokens enabling account takeover, and Cisco Talos published technical analysis and detection signatures.