Cisco Talos Tracks UAT-11985 Google AiTM Phishing

Cisco Talos says UAT-11985 has used event lures and a Google AiTM kit since mid-2026 to steal Taiwan researchers’ sessions after MFA.

Cisco Talos is tracking UAT-11985, called an APT cluster in the newest report, spear-phishing people affiliated with research organizations in Taiwan since mid-2026. Event invitations reused real details and impersonated the Taiwan European Union Centre, NCCU Institute of International Relations, and Taiwan Research Institute, with spoofed or Google Forms-looking links and posters whose QR codes were altered or swapped. A fake Google sign-in relayed passwords and MFA challenges over WebSockets and, according to two reports, HTTP, then captured session tokens. Sources differ on the lures: one says Talos saw signs of AI-assisted writing but could not prove a large language model produced the messages, while a later report says nearly identical structure indicates template-driven, likely AI-assisted generation. They also differ on language: one cites moderate confidence that the kit interface originated in Simplified Chinese; another says moderate confidence that Simplified Chinese was the developer’s main working language and that Talos did not claim state sponsorship; the newest report says the fake login supports only Chinese and English, while an earlier report specifies zh-CN, zh-TW, and English by browser language. Cited detections include ClamAV Html.Phishing.UAT11985-10060614-0 and Snort rules 1:67198 and 7:31, and Talos published phishing URLs and sender addresses.

• Cisco Talos tracks UAT-11985; the Oct. 16 report calls it an APT cluster spear-phishing Taiwan research affiliates since mid-2026.
• Lures impersonated the Taiwan European Union Centre, NCCU Institute of International Relations, and Taiwan Research Institute and reused real event details.
• Emails used spoofed or Google Forms-looking links; posters carried altered or swapped QR codes.
• An adversary-in-the-middle kit relayed Google passwords and supported MFA over WebSocket—and, in two reports, HTTP—then captured session tokens.
• Sources disagree on lure writing: one says Talos could not prove a large language model wrote them; a later report calls nearly identical emails template-driven and likely AI-assisted.
• Language claims differ: moderate confidence the kit interface originated in Simplified Chinese versus moderate confidence that was the developer’s main language, with no state-sponsorship claim; panels offered zh-CN, zh-TW, and English,…
• Cited detections are ClamAV Html.Phishing.UAT11985-10060614-0 and Snort rules 1:67198 and 7:31; Talos also published phishing URLs and sender addresses.