UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing
APT campaign uses fake event invites to target Taiwan research affiliates with Google AitM phishing.
Summary
A new APT spear-phishing campaign, tracked as UAT-11985, is targeting individuals affiliated with Taiwanese research organizations. The campaign employs fake event invitations to lure victims into clicking malicious links. These links redirect users to an adversary-in-the-middle (AitM) phishing framework, designed to steal Google account credentials and multi-factor authentication (MFA) codes.
The lesson from this incident
Full lessonThe UAT-11985 campaign demonstrates how sophisticated threat actors use socially engineered spear-phishing lures — in this case, fake event invitations — to trick targeted individuals into surrendering credentials and MFA codes via an adversary-in-the-middle (AitM) framework. AitM attacks are particularly dangerous because they defeat traditional MFA by proxying the authentication session in real time, rendering SMS and TOTP-based MFA ineffective. Research institutions are high-value targets for nation-state actors due to their access to sensitive intellectual property and government-adjacent data. This attack underscores that even security-conscious users can be deceived by contextually relevant lures, and that MFA alone is not a silver bullet against advanced phishing techniques.
What helps against this
How we list vendors- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.