Attackers have deployed a fresh phishing toolkit that exploits live WebSocket connections to break past multi-factor authentication (MFA) for Google accounts. The scheme, uncovered mid-2026, forwards each step of Google’s login workflow in real time—stealing credentials and session tokens rather than trying to break verification by brute force.
Targets are largely researchers and policy experts in Taiwan, who receive emails positioned as event or academic workshop invitations. The messages falsely come from institutions like the Taiwan European Union Centre, NCCU’s Institute of International Relations, or the Taiwan Research Institute. Though event particulars are sometimes accurate, the sender identities are forged or impossible to verify. Embedded registration links lead victims into credential theft traps rather than legitimate forms.
How the WebSocket Relay Works
The campaign’s infrastructure relies on a hybrid method that combines HTTP POST calls with persistent WebSocket channels. Victims start at a fake Google Form, then move to a replica of Google’s actual sign-in process. First, frontend data—device, browser, and language info—is sent via HTTP. After a WebSocket link is established, the phishing page dynamically updates based on every login challenge Google presents to the user.
When victims enter identifiers like email or phone, or provide passwords, all of that is forwarded to the attackers. Should Google issue a secondary authentication step, like a prompt or challenge, the fake page adapts in real time using instructions from the WebSocket stream. The attackers can then capture session tokens—auth data that grants full access without needing the password again—allowing full account takeovers.
The kit supports multiple languages—Simplified and Traditional Chinese as well as English—with indications that the creators’ primary working language is Simplified Chinese. The operation also features convincing design elements like real event posters, which may be modified to include malicious QR codes, broadening the technical reach of the scam to people who never receive the initial email.
How to Protect Against This Threat
The research team behind the discovery recommends organizations move toward phishing-resistant authentication methods, such as hardware keys or protocols like FIDO. Users should double-check the authenticity of unexpected event invitations—confirming sender identities and cross-verifying with institutions. If a breach is suspected, defenders need to look past passwords: session theft during a successful MFA flow may allow attackers to bypass many traditional defenses.
Key indicators include phishing domains like “google.morelessty[.]com” or “accounts.natrlyi[.]com” and email addresses that mimic academic staff but are unrelated. Security tools like Snort or ClamAV now include detection signatures specific to this toolkit.
This campaign highlights the limits of MFA when attackers mimic the legitimate login flow rather than cracking it. Forwarding MFA prompts in real time is proving to be a powerful method for circumventing authentication—something all organizations, especially those in academia and policy, need to harden against.
