Fake Event Invites Target Google Passwords and MFA Codes

A phishing campaign is using convincing event invitations and altered QR codes to steal Google passwords and multi-factor authentication codes. The known targets are connected to research organizations in Taiwan, but the tactic matters to US households and small offices because a malicious poster can reach anyone who scans it.

What happened

According to The Hacker News, attackers impersonated respected academic and policy organizations while promoting real or believable public events. The campaign, which Cisco Talos first observed in mid-2026, used similar writing patterns across invitations covering different geopolitical subjects.

Some emails contained a registration link leading to attacker-controlled systems. The link was made to appear connected to Google Forms when a recipient hovered over it. Other invitations reused genuine event posters but replaced their QR codes with malicious ones, potentially exposing people who encountered printed copies as well as the original email recipients.

After opening the false registration form, a victim was prompted to sign in with a Google account. The next page closely copied Google’s login screen but acted as an adversary-in-the-middle proxy. It collected the account name, password and authentication challenges while relaying information to Google’s real sign-in service. The phishing code also gathered browser and device details, including language, screen size and whether the visitor was using a mobile device.

Who is affected

The documented campaign targeted people affiliated with Taiwan research organizations. The fake login panels supported Simplified Chinese, Traditional Chinese and English, and selected a language using the victim’s browser settings. The source does not report a campaign aimed broadly at US consumers.

However, people in the United States may receive similar invitations for conferences, school events, community meetings or professional programs. A familiar institution, polished poster or working Google sign-in flow should not be treated as proof that an invitation is genuine.

What to do now

1. Do not scan a QR code or open a registration link from an unexpected event invitation. Find the organization’s official website independently and look for the event there.

2. Do not rely only on the address shown when hovering over a link. In this campaign, attackers made the destination appear related to Google Forms even though it led into their phishing system.

3. If a form unexpectedly asks for your Google password, close it. Open Google’s account page yourself from a saved bookmark or by typing the address rather than returning through the invitation.

4. If you entered a password or authentication code, change the Google password from the real account settings and review the account’s security activity and signed-in devices. Remove anything you do not recognize.

5. Replace any reused version of that password on other accounts. Store a different password for every service in a password manager.

6. Consider protecting important accounts with a physical security key where the service supports one, especially because this phishing system was designed to capture ordinary authentication codes.