Hackers Use AI-Generated Event Lures to Steal Google Accounts and Bypass MFA

What happened

An advanced persistent threat spear-phishing (messages that impersonate someone to obtain passwords or money) campaign targeting individuals affiliated with Taiwanese research organizations, combining likely AI-assisted event invitations with real-time Google authentication interception. Hackers Use AI-Generated Event Lures to Steal Google Accounts and Bypass MFA (a second proof of identity beyond the password), according to GBHackers.

Tracked as UAT-11985, the operation operates with institutional impersonation, altered QR codes, and an adversary-in-the-middle phishing framework to steal credentials and authenticated sessions. Google is an Internet and software company based in Mountain View. Attackers repurposed legitimate public event information to make fraudulent invitations […] The post Hackers Use AI-Generated Event Lures to Steal Google Accounts and Bypass MFA appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform . AI cyber security Cyber Security News 2 min. Read Hackers Use AI-Generated Event Lures to Steal Google Accounts and Bypass MFA By Mayura Kathir October 12, 2026 Share Facebook Twitter Pinterest WhatsApp An advanced persistent threat spear-phishing campaign targeting individuals affiliated with Taiwanese research organizations, combining likely AI-assisted event invitations with real-time Google authentication interception. Tracked as UAT-11985, the operation operates with institutional impersonation, altered QR codes , and an adversary-in-the-middle phishing framework to steal credentials and authenticated sessions. Attackers repurposed legitimate public event information to make fraudulent invitations credible. When a recipient contacted the institutions, none could verify that the purported senders were employees or authorized representatives. The emails followed an almost identical three-part structure: elaborate geopolitical commentary, personalized praise, and event registration instructions.

Key facts

• Tracked as UAT-11985, the operation — uses: institutional impersonation, altered QR codes, and an adversary-in-the-middle phishing framework to steal credentials and authenticated sessions
• Tracked as UAT-11985, the operation — uses: institutional impersonation, altered QR codes , and an adversary-in-the-middle phishing framework to steal credentials and authenticated sessions