UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing

UAT-11985, an advanced persistent threat group, has conducted a spear-phishing campaign targeting individuals affiliated with Taiwan research organizations using fake event invitations. The emails impersonate legitimate institutions and include malicious links or QR codes that direct victims to adversary-in-the-middle (AitM) phishing sites mimicking Google Forms and Google login pages. These sites harvest Google credentials and multi-factor authentication codes in real time, enabling full account takeover, with infrastructure tailored to Chinese-speaking users by supporting Simplified and Traditional Chinese locales.

AI-extracted · verify before operational use