/
← Voltar ao feed
high research academia think tanks

UAT-11985 targets Taiwan research affiliates with AI-assisted event-invite phishing and Google AitM credential and MFA theft

1 fonte(s) · 1 atualização(ões) · publicado 16/10/2026 13:16 · coletado há 1 dia

Cisco Talos disclosed an APT spear-phishing and quishing campaign, tracked as UAT-11985, that targets individuals affiliated with Taiwan research organizations. First seen in mid-2026, it uses fake event invitations to lead victims to an adversary-in-the-middle (AitM) phishing framework that harvests Google account credentials and MFA codes. Talos assesses the lures were likely produced with AI-assisted content generation from a reusable prompt template. The actor impersonates institutions such as the Taiwan European Union Centre, NCCU Institute of International Relations and Taiwan Research Institute. Talos says the aim is full account takeover.

Technical Details

  • Spear-phishing emails embed a URL to attacker-controlled infrastructure, while hovering over the link shows a legitimate-looking Google Forms URL.
  • In a subset of cases, legitimate event posters scraped from real sites carry modified malicious QR codes (quishing). This reaches secondary victims who see printed materials.
  • The emails follow a three-part structure: an elaborate geopolitical context, personalized flattery, then event logistics and registration instructions.
  • The phishing site imitates a Google Form and shows a pop-up prompting a Google sign-in. That leads to a spoofed Google login panel acting as an AitM proxy.
  • Obfuscated JavaScript collects the locale, user agent, screen dimensions and mobile status, and reports them to the C2 via a google_login_start request.
  • The password, account identifier and user agent are sent to the HTTP C2 via google_login_check. The C2 relays them to the real Google authentication service.
  • Credentials and authentication challenges are exfiltrated in real time over a WebSocket connection, while POST requests handle one-shot uploads.
  • The login panels support only zh-CN, zh-TW and English, with region detection via navigator.languages. This suggests targeting of Chinese-speaking users.

Remediation

The article does not provide specific remediation guidance.

Linha do tempo

  1. thehackernews.com ↗ · pub. 16/10/2026 13:16 · coletado 19/10 17:53 primeiro registro

    UAT-11985 targets Taiwan research affiliates with AI-assisted event-invite phishing and Google AitM credential and MFA theft

    ler a análise desta fonte

    Cisco Talos disclosed an APT spear-phishing and quishing campaign, tracked as UAT-11985, that targets individuals affiliated with Taiwan research organizations. First seen in mid-2026, it uses fake event invitations to lead victims to an adversary-in-the-middle (AitM) phishing framework that harvests Google account credentials and MFA codes. Talos assesses the lures were likely produced with AI-assisted content generation from a reusable prompt template. The actor impersonates institutions such as the Taiwan European Union Centre, NCCU Institute of International Relations and Taiwan Research Institute. Talos says the aim is full account takeover.

    Technical Details

    • Spear-phishing emails embed a URL to attacker-controlled infrastructure, while hovering over the link shows a legitimate-looking Google Forms URL.
    • In a subset of cases, legitimate event posters scraped from real sites carry modified malicious QR codes (quishing). This reaches secondary victims who see printed materials.
    • The emails follow a three-part structure: an elaborate geopolitical context, personalized flattery, then event logistics and registration instructions.
    • The phishing site imitates a Google Form and shows a pop-up prompting a Google sign-in. That leads to a spoofed Google login panel acting as an AitM proxy.
    • Obfuscated JavaScript collects the locale, user agent, screen dimensions and mobile status, and reports them to the C2 via a google_login_start request.
    • The password, account identifier and user agent are sent to the HTTP C2 via google_login_check. The C2 relays them to the real Google authentication service.
    • Credentials and authentication challenges are exfiltrated in real time over a WebSocket connection, while POST requests handle one-shot uploads.
    • The login panels support only zh-CN, zh-TW and English, with region detection via navigator.languages. This suggests targeting of Chinese-speaking users.

    Remediation

    The article does not provide specific remediation guidance.