Event Invites Used for Real-Time Google AitM Phish

Cisco Talos observed an APT spear-phishing campaign targeting people affiliated with Taiwan research organizations using credible-looking public event invitations. Attackers impersonated well-known academic/policy institutions, used mismatched “safe-looking” registration links, and in some cases altered event posters by swapping in malicious QR codes. The phishing infrastructure then redirected victims to a spoofed Google sign-in flow designed to capture credentials and MFA in real time (AitM).

Key findings

• Targets were individuals affiliated with Taiwan research organizations using “legitimate public event themes” and impersonation of “reputable academic and policy institutions.”
• Emails used a consistent three-part template with “polished (but overly elaborate)” geopolitical context, targeted flattery, and event logistics to build trust.
• Registration links were deceptive: “one hyperlink displays a legitimate-looking Google Forms URL, while its underlying href redirects the recipient to a deceptive phishing site.”
• Attackers extended the lure beyond email by altering real event posters: “the embedded QR codes were maliciously altered,” enabling QR-code phishing (“quishing”).
• Phishing infrastructure used an “adversary in the middle (AitM)” approach to “interception of credentials and multi-factor authentication (MFA) challenges” via real-time synchronization.

Who’s being targeted

• Commonly targeted roles: Research staff, Faculty/academics, Executive leadership at research institutes, Administrative assistants / coordinators, Communications and office management teams (poster handling).
• Affected industries: Research organizations, Higher education / academic institutes, Public policy / think tanks.
• Attack channels: email, website, physical.
• Impersonated: Taiwan European Union Centre / NCCU Institute of International Relations / Taiwan Research Institute (impersonated senders), Legitimate event organizers (poster scraped from real websites).

Awareness takeaways

• Treat event invitations as high-risk: verify the sender identity and the event registration page via official websites, not links inside the email.
• Hover and verify: a link that *looks* like a trusted service (e.g., Google Forms) can still send you somewhere else.
• Be cautious with QR codes on posters and printed materials; treat them like clickable links and validate the destination before proceeding.
• If an “event registration” flow unexpectedly forces a Google login, stop and confirm with the organizer through trusted contact methods.

Red flags to watch for

• Visible link text looks trustworthy, but the click destination is different (mismatched URL).
• Overly grand, generic policy language and broad flattery rather than specific knowledge of the recipient.
• Unexpected Google sign-in prompt during “event registration.”
• Poster looks authentic but the QR code has been altered.
• Unsolicited request to print/post materials in the workplace.
• QR code leads to a login flow that resembles Google sign-in, not an event registration confirmation.