The campaign relies on social engineering rather than software exploits. Targets receive what appear to be legitimate event invites, and clicking through redirects them to a phishing page that proxies the real Google login flow. Because the victim interacts with a live, proxied session, the attackers can capture both passwords and the MFA codes entered during authentication — a technique that defeats many forms of MFA, including one-time passcodes and push-based prompts.

Key points from the disclosure:

• The threat actor is tracked as UAT-11985.
• The targeting focuses on people affiliated with Taiwan research organizations.
• Initial contact comes via fake event invitations.
• The credential harvesting is performed through an AitM phishing framework impersonating Google.
• Both account credentials and MFA codes are at risk of being captured.

Additional technical details, including any specific indicators of compromise or mitigation guidance, were not included in the available reporting. Organizations and individuals in research-focused roles should treat unexpected event invitations — especially those leading to login pages — with heightened suspicion, and should verify links before authenticating with any account.

Source: The Hacker News
Has anyone in your organization received similar fake event invites, and how are you handling verification of external links?