UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing
Cisco Talos says UAT-11985 uses fake event invites and Google AitM phishing against Taiwan research affiliates.
64
ProductGoogle
- Mentions · 7d0
- Mentions · 30d2
- All mentions8
- First seenAug 24, 2026
- Last mentioned26d ago
Timeline
8 articles · newest firstFake Calendly “Meta Careers” pages steal Facebook and Google logins
Fake Calendly pages posing as Meta interviews steal Facebook and Google passwords plus two-factor codes.
58
Google AitM Phishing Kit Uses WebSockets to Bypass MFA in Real Time
Cisco Talos says UAT-11985 uses a Google AiTM kit to steal sessions from Taiwan-linked researchers.
68
Hackers Use AI-Generated Event Lures to Steal Google Accounts and Bypass MFA
UAT-11985 used likely AI-written event invites and an AiTM kit to steal Google sessions from Taiwan researchers.
72
UAT-11985: AI-assisted event lures delivering real-time Google AitM phishing
Cisco Talos says UAT-11985 phished Taiwan researchers with AI-assisted event lures and real-time Google AitM.
74
Critical MaxKB AI Agent Flaw Lets Prompt Injection Execute System Commands
A critical vulnerability in the MaxKB AI knowledge-base platform lets attackers execute OS commands via prompt injection, using the sandbox shell backend and elevated privileges; it can lead to remote code execution.…
45
Google fined €403 million over location data privacy violations
Ireland’s Data Protection Commission fined Google €403 million for processing location data violating GDPR.
10
iAuthFlow v2: The $10,000 Phishing Toolkit That Survives Your Password Reset
Abnormal Security details iAuthFlow v2, a $10,000 phishing kit that enrolls attacker-controlled passkeys on Google accounts, persisting through password resets.
63
Appears with
- Googlevendor · 7
- Cisco Talosorganization · 4
- UAT-11985threat actor · 4
- Taiwan European Union Centreorganization · 4
- NCCU Institute of International Relationsorganization · 4
- Taiwan Research Instituteorganization · 4
- Ciscovendor · 2
- LockBitthreat actor · 1
- Microsoftorganization · 1
- Calendlyproduct · 1
- Abnormal Securityorganization · 1
- Google Workspaceproduct · 1
- Data Protection Commissionvendor · 1
- Metavendor · 1
- MLM-001malware · 1
- Google Formsproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.