Google Phishing Kit Bypasses MFA with WebSockets in Real Time

Key Takeaways

• A sophisticated Google account phishing kit, dubbed UAT-11985, employs live WebSocket connections to bypass multi-factor authentication (MFA) in real time.
• The campaign specifically targets individuals associated with research organizations in Taiwan, using highly convincing, fake academic event invitations.
• Attackers leverage a Man-in-the-Middle (AitM) technique, relaying authentication requests and stealing authenticated session tokens.
• The kit dynamically adjusts the fake login interface based on real-time interactions with Google’s authentication service, making it highly effective.
• Organizations should prioritize phishing-resistant authentication methods and independent verification of suspicious communications.

Advanced Phishing Kit Bypasses MFA for Google Accounts via WebSockets

A new and highly effective phishing kit targeting Google accounts is actively leveraging real-time WebSocket connections to circumvent multi-factor authentication (MFA). This sophisticated operation, identified as UAT-11985, guides victims through meticulously crafted fake sign-in sequences, relays authentication requests to legitimate Google services, and ultimately steals authenticated sessions.

This campaign highlights a growing trend where attackers focus on forwarding legitimate login steps in real time, rather than attempting to directly compromise or crack security protocols. This method allows them to effectively bypass MFA, as the victim unknowingly completes the authentication process through the attacker’s controlled infrastructure.

The primary targets of this operation are individuals affiliated with research organizations in Taiwan. Attackers craft highly convincing phishing emails that masquerade as invitations to academic and policy-related events. These emails incorporate authentic event details, but utilize fabricated sender identities and embedded malicious registration links, designed to appear as routine professional correspondence while facilitating credential theft.

Researchers from Cisco Talos identified the UAT-11985 campaign during mid-2026. Their detailed threat research report, published on October 8, provides an in-depth analysis of the phishing kit’s mechanisms. The Talos analysis describes an operator-driven system that seamlessly integrates standard HTTP requests with dynamic WebSocket updates to meticulously mimic Google’s legitimate authentication flow.

Google AitM Phishing Kit Leverages Deception

The phishing emails impersonated several prominent institutions, including the Taiwan European Union Centre, the NCCU Institute of International Relations, and the Taiwan Research Institute. Investigations revealed that none of these institutions could verify the individuals listed as senders or representatives. The attackers enhanced the credibility of their fabricated identities by incorporating accurate details about genuine events.

Each phishing message typically followed a consistent structure: an opening statement related to policy, personalized praise for the recipient, and clear instructions for registration. This approach mirrors the session theft risks observed in Tycoon 2FA phishing attacks, where a deceptive login page acts as an intermediary between users and a genuine authentication service.

Talos also noted stylistic characteristics in the email content suggestive of AI-assisted writing, such as repetitive sentence structures, generic compliments, and rapid contextual shifts for different topics and recipients. While the researchers could not definitively confirm that an AI large language model generated the entire email content, the findings strongly indicate likely AI assistance in the crafting of these deceptive messages.

Beyond email, the attackers also modified legitimate event posters, replacing original QR codes with malicious ones. Talos warned that this tactic could expose a broader audience, including individuals who never received the initial phishing emails. The familiarity of the poster design provided no guarantee that its embedded registration code would lead to a secure destination.

How the WebSocket MFA Relay Works

The attack chain begins when victims interact with a fake Google Form, which then redirects them to a meticulously replicated Google sign-in page. Unlike simpler password-harvesting forms, this advanced kit allows an operator to control each stage of the authentication process in real time. This persistent connection capability, similar to JWR WebSocket phishing techniques (though those target banking information), enables live interaction.

The kit intelligently separates data submission from interface updates. HTTP POST requests are used to transmit critical information such as browser details, account identifiers, passwords, and challenge responses to the attacker’s command-and-control infrastructure.

Concurrently, a persistent WebSocket connection is maintained to deliver instructions back to the victim’s browser, dictating which authentication screen to display next. This architectural separation ensures that data uploads are handled distinctly while allowing for rapid, dynamic adjustments to the login interface during the session.

The initial interaction, signaled by a `google_login_start` request, gathers user-agent information, language settings, screen size, and mobile device status. Following the creation of a session, the script establishes its WebSocket connection. Subsequently, a `google_input_identifier` event transmits the victim’s email address or phone number, which is then verified against Google’s authentic authentication service.

Upon password entry, the `google_login_check` event forwards the password along with the account identifier and browser information. If Google’s legitimate service requires an additional verification step (e.g., an MFA prompt), the attacker dynamically updates the fake interface via WebSocket messages to display the corresponding challenge.

Cisco Talos reports that this synchronized relay mechanism facilitates the theft of authenticated session tokens. This enables attackers to take over the victim’s account immediately after all requested authentication checks, including MFA, have been successfully completed by the unsuspecting user.

The kit’s JavaScript code is obfuscated using Base64 strings and iterative array rotation to evade detection. The user interface supports Simplified Chinese, Traditional Chinese, and English. Talos assessed with moderate confidence that Simplified Chinese was the primary development language, though this finding alone does not establish the origin or state sponsorship of the attackers.

It is crucial to understand that a successfully completed MFA prompt does not inherently guarantee a secure session in the face of such advanced AitM attacks. As demonstrated by prior session cookie theft methods like Mirage2FA, attackers can effectively reuse authentication material captured during a relayed login.

What You Should Do

• Prioritize Phishing-Resistant MFA: Implement and enforce phishing-resistant multi-factor authentication methods such as FIDO2 security keys (e.g., YubiKey) or certificate-based authentication. These methods are designed to prevent session token theft via AitM attacks.
• Independent Verification: Always independently verify unexpected invitations, especially those related to professional or academic events. Contact the purported sender or institution directly through official channels (not links or contact information provided in the suspicious email).
• Educate Users on AitM Phishing: Conduct regular security awareness training that specifically highlights the dangers of real-time phishing attacks that bypass MFA. Emphasize that even after entering an MFA code, a session might be compromised if the initial login page was malicious.
• Monitor for Session Theft: Implement robust monitoring for unusual login activity, changes in account settings, or access from unfamiliar locations. Investigate any suspected session theft immediately, rather than solely relying on password changes.
• Review Email Security: Strengthen email gateway security with advanced threat protection, sandboxing, and URL rewriting capabilities to detect and block sophisticated phishing attempts.
• Implement Endpoint Detection and Response (EDR): Deploy EDR solutions to detect and respond to suspicious activity on endpoints, including the execution of malicious scripts or unauthorized data exfiltration that might follow a successful account takeover.

Indicators of Compromise (IoCs):-

Talos also provided the following detection coverage, which refers to defensive signatures rather than additional infrastructure indicators:

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.