A China-linked threat actor, UNC6508, ran a 26-month espionage campaign against U.S. and Canadian medical, academic, and military research institutions by first compromising REDCap research data servers, then abusing a native Google Workspace administrative feature to silently redirect sensitive email to attacker-controlled accounts. Because the technique exploits built-in platform functionality rather than malware, it left no traditional forensic artifacts and evaded standard endpoint and network controls throughout the campaign. Organizations holding clinical trial data, defense research, or academic intellectual property face material risk of sustained, undetected data loss with significant regulatory, legal, and reputational consequences.