{"id":3587,"date":"2026-10-16T17:04:57","date_gmt":"2026-10-16T17:04:57","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3587"},"modified":"2026-10-16T17:04:57","modified_gmt":"2026-10-16T17:04:57","slug":"uat-11985-uses-fake-event-invites-to-target-taiwan-research-affiliates-with-google-aitm-phishing","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3587","title":{"rendered":"UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Oct 16, 2026<\/span><\/span>Phishing \/ Artificial Intelligence<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Cybersecurity researchers have disclosed details of an advanced persistent threat (APT) spear-phishing campaign that has targeted individuals affiliated with Taiwan research organizations to direct victims to an adversary-in-the-middle (AitM) phishing framework designed to harvest their Google account credentials and multi-factor authentication (MFA) codes.<\/p>\n

The activity is being tracked by Cisco Talos under the moniker UAT-11985<\/strong>, describing it as likely fueled by artificial intelligence (AI)-assisted content generation so as to quickly craft bespoke lures aimed at different targets within the confines of a common social engineering framework. The campaign was first observed in mid-2026.<\/p>\n

\u00abThe operation leveraged legitimate public event themes and impersonated reputable academic and policy institutions to establish credibility,\u00bb Talos researcher Joey Chen said<\/a> in an analysis.<\/p>\n

\u00abBeyond traditional email phishing, the actor incorporated QR code phishing (quishing) techniques by modifying legitimate event posters with malicious QR codes, expanding the attack surface beyond email recipients to secondary victims who may encounter printed materials.\u00bb<\/p>\n

Central to the operation is the use of legitimate or plausible public event information in spear-phishing emails and embedding within them a URL that points to attacker-controlled infrastructure, while hovering over the hyperlink displays a legitimate-looking Google Forms URL.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

These invitation emails feature nearly identical syntactic structures despite the breadth of geopolitical topics being discussed, indicating the content was mass-produced from a reusable prompt template rather than painstakingly crafted for each target.<\/p>\n

<\/p>\n

Specifically, the emails follow a three-part structure –<\/p>\n