Google Session Hijacking Kit Mirrors Logins via WebSockets to Target Taiwan Academics

Cisco Talos researchers identified a sophisticated phishing operation, tracked as UAT-11985, that compromises Google accounts by bypassing multi-factor authentication through real-time session relaying. The threat group targets individuals affiliated with research institutions in Taiwan, using tailored social engineering to trick victims into interacting with malicious infrastructure that mirrors Google’s official authentication flow.

The risk

The core danger lies in the use of live WebSocket connections to maintain a bridge between the victim and the genuine Google service, according to Cyber Security News. Instead of collecting static credentials, the kit allows an operator to guide the victim through each step of the login process. This real-time relay ensures that two-factor authentication codes are validated by Google before the attacker captures the resulting session token, effectively neutralizing standard MFA protections.

Who is exposed

Researchers from Cisco Talos detailed this campaign in an October threat research report published on October 8, noting it emerged during mid-2026. The operation specifically targets people linked to research organizations in Taiwan. Emails pose as invitations to academic and policy events, impersonating entities such as the Taiwan European Union Centre, NCCU Institute of International Relations, and the Taiwan Research Institute to establish credibility with targeted professionals.

Cost and compliance

According to the source material, the attackers constructed emails with policy-themed openings and tailored praise to mimic routine professional correspondence. When recipients verified the sender identities with the actual institutions, none could confirm the individuals were employees. The campaign also involved copying legitimate event posters and replacing their QR codes with malicious ones, suggesting that printed materials could expose additional victims who never received the original email messages.

What to watch

Managers should monitor for unexpected session activity or login alerts from unfamiliar locations, as these kits steal active sessions rather than just passwords. Teams should verify the authenticity of event invitations through official channels, not just the provided links or QR codes. Awareness of AI-assisted writing patterns, such as repetitive sentence structures and broad compliments, can help staff identify suspicious communications before they interact with the malicious forms.

What to do and how to stay safe: Google

• Verify the authenticity of any academic or policy event invitation by contacting the host organization through known, trusted contact details rather than clicking links in the email.
• Scan QR codes from printed materials with a secondary device that can inspect the destination URL before accessing it, ensuring it leads to a legitimate domain.
• Treat emails containing generic praise or repetitive phrasing as suspicious, especially if they request immediate registration or account verification.
• Once the vendor provides an update regarding session security or relay detection, deploy it immediately to reduce the window of exposure for authenticated users.

Step-by-step guide: Security Awareness Training: 6 Misunderstandings That Waste Your Budget

General security guidance from the SecOps Signal newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How does this phishing kit bypass multi-factor authentication?

It uses live WebSocket connections to relay authentication requests in real time, allowing the attacker to validate MFA codes with Google before stealing the resulting session.

Who is primarily targeted by this campaign?

The operation targets individuals linked to research organizations in Taiwan, using emails that impersonate legitimate academic institutions and event organizers.

Did the attackers use AI to create the phishing emails?

Cisco Talos noted signs of AI-assisted writing, such as repeated patterns, but could not prove that a large language model generated the complete emails.