[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fcEBL1RT-P8CVYAeIYTyiIbA-y2ExrpFRGUNFgge5Rvc":3},{"article":4,"iocs":48,"watch_terms":49,"solutions":50,"lesson":137},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"e805c86a-03fe-4b0e-9d72-9d4fa74a743b","UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing","uat-11985-uses-fake-event-invites-to-target-taiwan-research-affiliates-with-goog-23e482","Cybersecurity researchers have disclosed details of an advanced persistent threat (APT) spear-phishing campaign that has targeted individuals affiliated with Taiwan research organizations to direct victims to an adversary-in-the-middle (AitM) phishing framework designed to harvest their Google account credentials and multi-factor authentication (MFA) codes. The activity is being tracked by","A new APT spear-phishing campaign, tracked as UAT-11985, is targeting individuals affiliated with Taiwanese research organizations. The campaign employs fake event invitations to lure victims into clicking malicious links. These links redirect users to an adversary-in-the-middle (AitM) phishing framework, designed to steal Google account credentials and multi-factor authentication (MFA) codes.","APT campaign uses fake event invites to target Taiwan research affiliates with Google AitM phishing.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fuat-11985-uses-fake-event-invites-to.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEiPclyw7bJ19im5Qmzj9jgFlsM4XJqPK6hyphenhyphenRDCcQ0bnpWrteeTWgPNlip5T0P_oj_AC6V3osZ2xIpYipKjXWQw3BfFEQ1n28dleNCLRi7difLnPLY8Yc-oJ6BCVZ1V0VBpF_ZNu36qM_yCvyvbgBsSfh2AXq-IBIk7QjnBSR_T7s8ajMCOkIEhA5YGeYWg4\u002Fs1600\u002Fgoogle-phish.jpg","2026-10-16T16:16:44+00:00","2026-10-16T18:00:02.995289+00:00",8,[17,20,23,25],{"name":18,"type":19},"UAT-11985","threat_actor",{"name":21,"type":22},"Adversary-in-the-Middle (AitM) phishing","technology",{"name":24,"type":22},"Google account credentials",{"name":26,"type":22},"multi-factor authentication (MFA)","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":27,"icon":29,"name":30,"slug":31},null,"Nation-state","nation-state",[33,38,43],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":39},{"id":40,"icon":29,"name":41,"slug":42},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":44},{"id":45,"icon":29,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[],{"controls":51,"vendors":136},[52,81,110],{"slug":53,"name":54,"problem":55,"products":56},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[57,65,73],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":82,"name":83,"problem":84,"products":85},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[86,94,102],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"slug":111,"name":112,"problem":113,"products":114},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[115,123,130],{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":124,"product_name":127,"url":128,"description":129},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":131,"product_name":132,"url":134,"description":135},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",[],{"slug":138,"title":139,"body":140,"framework_refs":141,"framework_notes":153},"aitm-phishing-campaign-bypasses-mfa-to-steal-google-credentials-from-taiwan-researchers","AitM Phishing Campaign Bypasses MFA to Steal Google Credentials from Taiwan Researchers","The UAT-11985 campaign demonstrates how sophisticated threat actors use socially engineered spear-phishing lures — in this case, fake event invitations — to trick targeted individuals into surrendering credentials and MFA codes via an adversary-in-the-middle (AitM) framework. AitM attacks are particularly dangerous because they defeat traditional MFA by proxying the authentication session in real time, rendering SMS and TOTP-based MFA ineffective. Research institutions are high-value targets for nation-state actors due to their access to sensitive intellectual property and government-adjacent data. This attack underscores that even security-conscious users can be deceived by contextually relevant lures, and that MFA alone is not a silver bullet against advanced phishing techniques.",[142,143,144,145,146,147,148,149,150,151,152],"CIS Control 9: Email and Web Browser Protections","CIS Control 14: Security Awareness and Skills Training","CIS Control 6: Access Control Management","NIST SP 800-63B: Digital Identity Guidelines (Phishing-Resistant AAL3)","NIST AC-17: Remote Access","NIST SI-3: Malicious Code Protection","NIST AT-2: Literacy Training and Awareness","MITRE ATT&CK T1557: Adversary-in-the-Middle","MITRE ATT&CK T1566.002: Spearphishing Link","ISO\u002FIEC 27001 A.8.5: Secure Authentication","GDPR Article 32: Security of Processing (for EU-affiliated research data)",{}]