**The Rise of AI-Powered Phishing Targeting Research Institutions**
Threat actors have recently launched a highly targeted phishing operation aimed at professionals affiliated with Taiwanese research organizations. The goal of this campaign is to steal Google account credentials and multi-factor authentication codes by using a sophisticated interception technique.
A recent analysis of the operation reveals that the attackers likely used automated text-generation tools to rapidly customize deceptive messages for different victims. The campaign was first observed in the middle of 2026 and relies on building trust through seemingly legitimate public events.
To establish credibility, the attackers framed their messages around real-world geopolitical and policy gatherings, impersonating respected academic and policy institutions. They also expanded their reach beyond email inboxes by altering printed event posters with malicious QR codes—a tactic known as quishing—ensnaring anyone who scanned the physical flyers.
At the core of the scheme, the attackers embedded links to their own servers within emails that looked like standard event invitations. Despite the varied topics discussed, the wording of these messages remained remarkably consistent, indicating a standardized, mass-produced template rather than individually crafted notes.
The emails follow a specific three-part formula. First, they provide an elaborate description of the geopolitical context. Second, they flatter the specific recipient to encourage engagement. Finally, they offer logistical details about the event, including the date, venue, and registration instructions.
Once a target clicks the link, they are taken to a webpage mimicking a standard Google Form. When the user attempts to submit the form, a pop-up prompts them to sign in with their Google account. The fake page secretly acts as a middleman, instantly capturing login details while simultaneously passing them to the real Google service to avoid suspicion. Hidden scripts quietly gather details about the victim’s device—such as language settings and screen size—and transmit this data to the attackers. The fake login screens were specifically tailored for Chinese-speaking users, supporting both simplified and traditional variants alongside English, indicating a focused effort on a specific demographic.
***
**FAQ: Understanding the Threat**
**What is an Adversary-in-the-Middle (AitM) attack?**
An AitM attack occurs when a hacker positions themselves between a victim and a legitimate service. Instead of stealing credentials directly, the attacker intercepts the login process in real time. They capture the victim’s password and multi-factor authentication codes, then immediately relay them to the genuine service, allowing the attacker to take over the account without the victim realizing anything is wrong.
**What is QR code phishing (quishing)?**
Quishing is a phishing technique where attackers replace the legitimate QR code on a physical poster or document with their own malicious code. When a victim scans the code with their phone, it redirects them to a fraudulent website designed to steal their credentials or install malware, bypassing traditional email security filters.
**How did the attackers use artificial intelligence in this campaign?**
The attackers likely used AI to quickly generate the body of the phishing emails. By using a reusable prompt template, they could mass-produce messages that maintained a consistent, polished tone and structure, saving time while making the emails appear highly customized to each target.
**How can individuals protect themselves from these types of attacks?**
Users should remain skeptical of unexpected event invitations, especially those asking them to log in via a pop-up window. It is safer to navigate to official websites by typing the URL directly into a browser rather than clicking links in emails or scanning QR codes from unknown sources. Enabling hardware security keys for multi-factor authentication can also prevent attackers from using stolen codes.
***
**Conclusion**
This campaign highlights how modern phishing operations combine social engineering with advanced technical interception to bypass traditional security measures. By leveraging AI for rapid content generation and AitM proxies to steal session cookies and credentials, threat actors are constantly evolving their tactics. Staying informed and maintaining a healthy skepticism toward unsolicited digital invitations are essential steps in protecting sensitive information from these highly targeted attacks.
Thank you for reading
