Hackers Use AI-Generated Event Lures to Steal Google Accounts and Bypass MFA

An advanced persistent threat spear-phishing campaign targeting individuals affiliated with Taiwanese research organizations, combining likely AI-assisted event invitations with real-time Google authentication interception.

Tracked as UAT-11985, the operation uses institutional impersonation, altered QR codes, and an adversary-in-the-middle phishing framework to steal credentials and authenticated sessions.

Attackers repurposed legitimate public event information to make fraudulent invitations credible. When a recipient contacted the institutions, none could verify that the purported senders were employees or authorized representatives.

The emails followed an almost identical three-part structure: elaborate geopolitical commentary, personalized praise, and event registration instructions.

References to authoritative perspectives, exclusive participation, and reserved seating exploited recipients’ professional standing.

Although topics and institutions changed, repetitive syntax and interchangeable compliments suggested a reusable content-generation template rather than independently written invitations.

Talos found strong evidence of AI-assisted production and personalization. However, they could not conclusively establish that a large language model generated the messages.

The distinction matters: fluent prose and formulaic rhetoric support an assessment, not definitive attribution. Authentic dates, venues, and event descriptions provided credibility while disguised registration links delivered victims to attacker-controlled infrastructure.

Talos observed that the spoofed Google login panels only support Simplified Chinese (zh-CN), Traditional Chinese (zh-TW), and English locales, with region detection based on the victim’s browser “navigator.languages”.

Cisco Talos Researchers said that, the campaign impersonated the Taiwan European Union Centre, NCCU Institute of International Relations, and Taiwan Research Institute.

AI-Generated Event Lures

One hyperlink displayed a legitimate-looking Google Forms address, but its underlying destination opened a phishing site hosted on a third-party platform.

Attached posters extended the deception: attackers copied authentic designs and replaced their QR codes.

Talos assessed that printed posters could expose additional victims scanning registration codes from office bulletin boards.

The malicious registration page imitated Google Forms before forcibly redirecting visitors to a counterfeit Google sign-in interface.

The kit supported Simplified Chinese, Traditional Chinese, and English, selecting its presentation through browser language preferences.

Obfuscated JavaScript embedded near the HTML document’s end used Base64 strings, array rotation, and control-flow manipulation to complicate analysis.

Unlike static credential collectors, the framework enables operator-driven authentication orchestration. HTTP POST requests transmit browser fingerprints, account identifiers, passwords, and challenge responses to command-and-control infrastructure.

A persistent WebSocket delivers instructions back to the victim’s browser, allowing attackers to change authentication screens in step with responses from Google’s legitimate authentication service.

The workflow begins with google_login_start, which submits device and browser information. The google_input_identifier event forwards an email address or phone number for account verification.

Password submissions use google_login_check. When Google requests additional verification, WebSocket updates render the corresponding challenge, keeping the counterfeit interface synchronized with the genuine authentication process.

This relay lets attackers capture authenticated session tokens after victims complete supported MFA challenges, enabling account takeover.

It is authentication interception rather than a disclosed Google vulnerability. Talos’ related analysis of the JWR phishing framework documents another operator-controlled WebSocket design, although researchers distinguish its implementation and campaign from UAT-11985.

Talos assessed with moderate confidence that the interface originated in Simplified Chinese, citing its base translation object, default-language branches, and mainland-oriented terminology.

Published detection coverage includes ClamAV signature Html.Phishing.UAT11985-10060614-0, Snort2 rule 1:67198, and Snort3 rule 7:31, providing defenders concrete references for identifying activity associated with this phishing framework across monitored organizational environments and networks.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.