Real-time MFA-relay phishing kits keep showing up. What's actually working against them for you?

Cisco Talos identified an APT spear-phishing campaign in mid-2026 targeting Taiwan-based research organizations. The threat actor used AI-assisted templates to generate personalized phishing emails impersonating reputable institutions and public events. The emails contained links that appeared legitimate but redirected to phishing sites hosting advanced adversary-in-the-middle kits. These kits impersonate Google authentication pages and use a hybrid HTTP and WebSocket architecture to relay credentials and MFA tokens in real time, enabling session hijacking. The campaign also employed quishing by embedding malicious QR codes in event posters, extending the attack beyond email. The phishing kits capture session cookies and device fingerprints, increasing the risk of persistent access. The localization and language usage suggest a developer with a Simplified Chinese background. The campaign demonstrates a high level of coordination, social engineering, and technical sophistication.

The campaign enables attackers to intercept user credentials and MFA tokens in real time, effectively bypassing multi-factor authentication protections. This can lead to unauthorized access to victim accounts and persistent session hijacking. The use of AI-assisted content generation increases the scale and personalization of phishing attempts, raising the likelihood of successful compromise. The addition of quishing expands the attack surface beyond email recipients to individuals exposed to printed materials. The campaign targets high-value research organizations, potentially exposing sensitive information and intellectual property.

No official vendor patch applies as this is a phishing campaign. Defenders should prioritize deploying strong authentication methods such as passkeys and device-bound sessions that are resistant to real-time MFA relay attacks. Implementing impossible-travel detection can help identify suspicious login patterns. Rapid takedown of lookalike domains and phishing infrastructure reduces attacker effectiveness. User education on recognizing phishing and quishing attempts remains important. Since the phishing kits relay credentials live, reliance solely on SMS or authenticator app codes is insufficient. Organizations should consider additional controls and monitoring tailored to these attack techniques.