China-Nexus Actor Spies on US Researchers Undetected for a Year

Google's Threat Intelligence Group disclosed a year-long China-nexus espionage campaign that harvested REDCap credentials via spear-phishing and credential-stuffing to gain persistent access to US universities and medical research institutions, quietly exfiltrating clinical and research data; Google disrupted the phishing infrastructure, shared IoCs with RedCAP administrators and US-CERT, and coordinated notifications with CISA and the FBI while recommending MFA, log reviews, network segmentation, and phishing training.