UAT-11985: AI-assisted event lures delivering real-time Google AitM phishing
Cisco Talos says UAT-11985 phished Taiwan researchers with AI-assisted event lures and real-time Google AitM.
Cisco Talos disclosed UAT-11985, an APT spear-phishing campaign against people affiliated with Taiwan research organizations. The actor impersonated the Taiwan European Union Centre, NCCU Institute of International Relations, and Taiwan Research Institute, reusing public event details and likely AI-assisted invitation templates. Hidden links and QR codes on modified posters sent victims to a real-time adversary-in-the-middle kit that impersonated Google login pages and intercepted credentials and MFA challenges over HTTP and WebSockets. Talos assesses with moderate confidence that the kit interface was originally developed in Simplified Chinese.