Cisco Talos researchers have published a detailed breakdown of a phishing kit that doesn’t just collect passwords, it actively relays victims through a real Google login in real time, letting a human or automated operator watch and respond to each authentication step as it happens. The technique, known as adversary-in-the-middle phishing, lets attackers bypass multi-factor authentication not by breaking it, but by sitting invisibly between the victim and Google’s actual sign-in service and forwarding each step along.

Talos tracks the operation as UAT-11985 and first observed it during mid-2026, publishing its full technical findings on October 8. The targets were people connected to research organizations in Taiwan, approached through emails disguised as invitations to academic and policy events.

A Convincing Setup Built on Real Details

The phishing emails impersonated three organizations: the Taiwan European Union Centre, the NCCU Institute of International Relations, and the Taiwan Research Institute. When Talos checked with those actual institutions, none could confirm that the purported senders were real employees or representatives, meaning the identities were fabricated even as the event details referenced in the emails were accurate. That mix of real event information with invented sender identities is what made the approach convincing: recipients checking the event itself would find it legitimate, even though the person inviting them wasn’t.

Talos also flagged stylistic signs consistent with AI-assisted writing in the emails, including repeated sentence structures and broadly tailored compliments that shifted easily between topics and recipients, though the researchers stopped short of proving a language model generated the complete messages. Beyond email, the attackers also doctored legitimate event posters, replacing the real QR codes with malicious ones, a tactic that could ensnare victims who never received the original phishing email at all, simply by scanning a poster they encountered elsewhere.

Inside the Real-Time Relay

The technical core of the operation is what sets it apart from ordinary credential-harvesting pages. Victims first land on a fake Google Form that redirects to a cloned Google sign-in page, but rather than simply storing whatever is typed into it, the kit actively drives victims through each stage of a real authentication flow using a persistent WebSocket connection.

Talos’s analysis breaks down the sequence as follows:

• An initial google_login_start request collects the victim’s browser language, user-agent, screen size, and device type, then opens a WebSocket connection tied to that session
• A google_input_identifier event sends the victim’s email address or phone number to be checked against Google’s genuine authentication backend
• Once a password is entered, google_login_check forwards it along with the account identifier and browser fingerprint
• If Google’s real system then demands a further verification step, such as an MFA prompt, the operator uses the open WebSocket to push live instructions telling the fake page exactly which screen to display next

That architecture, separating bulk data uploads over HTTP from instant screen-update commands over WebSocket, lets the kit react to Google’s authentication flow as it unfolds, rather than relying on a static, pre-scripted fake login sequence. The end result, according to Talos, is theft of fully authenticated session tokens, giving attackers account access even after a victim correctly completes an MFA challenge they believed was protecting them.

A Familiar Threat With a More Dynamic Delivery

The core idea, intercepting a live login session to defeat MFA, isn’t new. Talos points to similarities with earlier kits like Tycoon 2FA, and Cyber Security News has separately reported on Mirage2FA, a kit that used stolen session cookies to hijack Microsoft 365 accounts across roughly 3,500 organizations. What distinguishes UAT-11985 is its use of persistent WebSocket connections to drive the fake interface dynamically rather than scripting a fixed sequence of fake pages in advance, giving operators more flexibility to react to whatever Google’s real authentication system actually asks for.

The kit’s interface supports Simplified Chinese, Traditional Chinese, and English, and Talos assessed with moderate confidence that Simplified Chinese was the developer’s primary working language, a finding the researchers were careful to note does not by itself establish the attacker’s nationality or any state affiliation.

Why Completing MFA Isn’t Enough

The central lesson from this campaign is uncomfortable but important: successfully completing a multi-factor authentication prompt does not guarantee a safe login session if that prompt was relayed through an attacker-controlled intermediary. Security teams are better served by phishing-resistant authentication methods, such as hardware security keys that cryptographically verify the destination domain, than by MFA factors that can be relayed step by step. Talos also recommends independently verifying unexpected event invitations through official channels before clicking registration links, and treating any suspected session theft as requiring more than a simple password reset, since a hijacked session token can remain valid regardless of password changes made afterward.