The delivery mechanisms include traditional email spear-phishing and QR code phishing (quishing), where malicious codes are embedded in scraped legitimate event posters. The campaign stands out for its use of an advanced adversary-in-the-middle (AitM) phishing framework. This framework utilizes a hybrid HTTP and WebSocket architecture to synchronize authentication workflows with legitimate Google services in real time, allowing the actor to intercept primary credentials and bypass MFA challenges seamlessly. Linguistic analysis of the phishing kit suggests a developer fluent in Simplified Chinese, with potential mainland-Chinese lexical origins. The campaign represents a sophisticated evolution in infrastructure, combining social engineering at scale with real-time credential theft.

Attack Chain

1. The actor scrapes legitimate public event data and posters from official institutional websites.
2. The actor uses AI-assisted templates to generate personalized invitation lures featuring professional flattery and specific geopolitical contexts.
3. Phishing lures are distributed via email, some containing modified posters with malicious QR codes (quishing) for physical-to-digital attack pivoting.
4. Emails contain hyperlinked registration buttons where the visible text presents a benign domain (e.g., Google Forms) but the underlying href directs victims to actor-controlled infrastructure.
5. Upon clicking the link, the victim is presented with a proxy interface that clones a legitimate Google authentication page.
6. The AitM framework uses a hybrid HTTP/WebSocket connection to proxy the user's interaction with the actual Google authentication backend in real time.
7. The actor captures the submitted credentials and the secondary MFA token as they are relayed through the framework.
8. The final objective is the unauthorized takeover of Google Workspace accounts belonging to researchers, enabling exfiltration or lateral movement.

Impact

The primary impact is the unauthorized compromise of research credentials, potentially leading to the exfiltration of sensitive policy, geopolitical analysis, or intellectual property held by Taiwan-based institutions. The use of AitM frameworks renders standard MFA ineffective, significantly lowering the barrier for account takeover. The campaign's use of quishing also broadens the scope of impact, potentially compromising personnel who are not the original email recipients but encounter the malicious posters in public or internal office spaces.

Recommendation

• Implement phishing-resistant MFA, such as FIDO2/WebAuthn hardware security keys, which are natively immune to AitM credential harvesting.
• Configure email security gateways to perform deep URL inspection and alert on discrepancies between visible link text and actual destination domains.
• Conduct employee awareness training focusing on the risks of QR code (quishing) scanning in unverified physical materials.
• Implement and enforce strict conditional access policies, such as geo-blocking or device health attestation, for all Google Workspace access.
• Monitor proxy and firewall logs for unusual WebSocket traffic patterns directed toward non-standard or newly registered domains.