Cybersecurity researchers have reported a spear-phishing campaign targeting individuals affiliated with research organisations in Taiwan, using fake event invitations to lure victims into a credential-harvesting attack against Google accounts. According to the researchers, the operation used an adversary-in-the-middle (AitM) phishing framework that can capture both account credentials and multi-factor authentication (MFA) codes.

Although the reported campaign appears focused on a specific group, the techniques described are relevant well beyond that target set. For European businesses using Google Workspace, cloud identity systems and email-based workflows, the case is a reminder that phishing attacks increasingly aim to bypass conventional MFA rather than just steal passwords.

What happened

According to the reported findings, the threat actor tracked as UAT-11985 sent fake event invitations as part of a spear-phishing campaign. The goal was to direct recipients to a phishing setup designed to impersonate legitimate Google login flows.

In an AitM attack, the phishing site sits between the user and the real service. That allows attackers to relay login traffic in real time and potentially capture usernames, passwords and one-time MFA codes entered by the victim. In some cases, such attacks may also enable session hijacking if authentication tokens are intercepted.

The source material describes the campaign as targeting individuals connected to Taiwan-based research organisations. Based on the information provided, this is a targeted espionage-style phishing operation rather than a mass-market spam campaign.

Why it matters for European businesses

Even when a campaign is geographically or politically focused, the underlying attack method matters to businesses elsewhere. AitM phishing has become an important business risk because many organisations still depend on combinations of password-based login and phishing-susceptible MFA methods such as SMS codes or app-based one-time passwords.

For European companies, the main relevance is operational rather than geopolitical. Many SMEs, agencies, e-commerce teams and knowledge-based organisations rely heavily on Google accounts for email, documents, calendars, advertising platforms, analytics tools and third-party SaaS access. If a single employee account is compromised, attackers may gain access to internal data, customer communications, invoices, marketing systems or shared files.

This type of attack can also create downstream risks including business email compromise, fraud, data exposure and further lateral movement into connected services. Organisations in regulated sectors may additionally face incident response, contractual and data protection consequences if account compromise leads to unauthorised access to personal or confidential data.

Who may be affected

The reported victims were linked to research organisations, but the technique is relevant to a much wider set of organisations:

• Businesses using Google Workspace for email, identity and collaboration
• Teams with high-value accounts such as executives, finance staff, IT administrators, researchers and partnership managers
• Marketing and e-commerce teams whose Google accounts connect to ads, analytics, tag management or merchant platforms
• Remote and distributed organisations where event invites and external collaboration requests are routine
• Companies handling sensitive information including R&D, commercial strategy, client data or regulated data sets

What companies should consider

Businesses do not need to be the named target of a campaign to learn from it. The practical lesson is that MFA alone is not always sufficient if the chosen method can be phished.

• Review MFA methods and prioritise phishing-resistant options where feasible, such as security keys or passkey-based approaches tied to the legitimate domain and device.
• Harden Google account security for privileged users first, including administrators, finance teams and employees with access to sensitive files or external-facing systems.
• Train staff on event-invite lures and other socially engineered collaboration requests, especially when they lead to login pages or urgent authentication prompts.
• Monitor for unusual sign-ins, impossible travel, new devices, suspicious mailbox activity and unauthorised OAuth or SaaS access.
• Reduce reliance on a single account for critical operations such as ads, analytics, billing and domain administration where separation of duties is possible.
• Prepare an account takeover response process covering session revocation, password resets, token review, admin audit checks and third-party app validation.

For European SMEs, the wider message is straightforward: targeted phishing now regularly tries to defeat standard authentication workflows, not just trick users into revealing passwords. Businesses that depend on cloud identity should assess whether their current login protections are resilient against modern phishing techniques, especially for users with access to sensitive data, finance functions or core digital infrastructure.