UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing
-
Cybersecurity researchers have disclosed details of an advanced persistent threat (APT) spear-phishing campaign targeting individuals affiliated with Taiwan research organizations. The operation, tracked as UAT-11985, uses fake event invitations to lure victims toward an adversary-in-the-middle (AitM) phishing framework built to harvest Google account credentials and multi-factor authentication (MFA) codes.
The campaign relies on social engineering rather than software exploits. Targets receive what appear to be legitimate event invites, and clicking through redirects them to a phishing page that proxies the real Google login flow. Because the victim interacts with a live, proxied session, the attackers can capture both passwords and the MFA codes entered during authentication — a technique that defeats many forms of MFA, including one-time passcodes and push-based prompts.
Key points from the disclosure:
- The threat actor is tracked as UAT-11985.
- The targeting focuses on people affiliated with Taiwan research organizations.
- Initial contact comes via fake event invitations.
- The credential harvesting is performed through an AitM phishing framework impersonating Google.
- Both account credentials and MFA codes are at risk of being captured.
Additional technical details, including any specific indicators of compromise or mitigation guidance, were not included in the available reporting. Organizations and individuals in research-focused roles should treat unexpected event invitations — especially those leading to login pages — with heightened suspicion, and should verify links before authenticating with any account.
Source: The Hacker News
Has anyone in your organization received similar fake event invites, and how are you handling verification of external links?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login