#adversary-in-the-middle

The kit sends your password to Google, relays the real prompt back, and keeps the session that comes out

Cisco Talos documented a spear-phishing campaign against people at Taiwanese research institutes that steals authenticated Google sessions in real time. The lures came as event invitations, some as QR codes on altered posters. Talos analysed three emails and is careful about what that proves.