UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing
AI-summarised brief · reviewed before publication
Cisco Talos has identified an AI‑assisted spear‑phishing operation, labeled UAT‑11985, that targets affiliates of Taiwanese research institutes. The campaign uses fake event invitations that impersonate bodies such as the Taiwan European Union Centre and NCCU Institute of International Relations. Emails contain legitimate‑looking event posters whose QR codes are swapped for malicious ones, directing victims to a spoofed Google Form. The form triggers an adversary‑in‑the‑middle (AitM) proxy that captures Google credentials and MFA codes, relaying them to real Google servers via WebSocket while exfiltrating device data. The phishing pages support Chinese and English locales and mimic Google’s login flow, enabling full account takeover without alerting users. Activity began in mid‑2026 and relies on a reusable AI‑generated template for continued espionage campaigns.
💡 Why It Matters
- · Real‑time hijacking of Google’s authentication lets attackers silently commandeer academic accounts, granting unfettered access to sensitive research communications.
