AitM Phishing Campaign Bypasses MFA to Steal Google Credentials from Taiwan Researchers
The UAT-11985 campaign demonstrates how sophisticated threat actors use socially engineered spear-phishing lures — in this case, fake event invitations — to trick targeted individuals into surrendering credentials and MFA codes via an adversary-in-the-middle (AitM) framework. AitM attacks are particularly dangerous because they defeat traditional MFA by proxying the authentication session in real time, rendering SMS and TOTP-based MFA ineffective. Research institutions are high-value targets for nation-state actors due to their access to sensitive intellectual property and government-adjacent data. This attack underscores that even security-conscious users can be deceived by contextually relevant lures, and that MFA alone is not a silver bullet against advanced phishing techniques.
Tactical Insight
Immediate actions
- Train staff to verify event invitations through official channels before clicking any embedded links.
- Migrate Google Workspace accounts to phishing-resistant MFA such as FIDO2/passkeys or hardware security keys, which cannot be intercepted by AitM frameworks.
Long-term improvements
- Implement a Zero Trust architecture requiring continuous verification of user identity and device posture before granting access to sensitive resources.
- Establish strict email filtering rules and link-rewriting policies that flag or sandbox unexpected external invitations and redirect URLs.
- Conduct regular spear-phishing simulations tailored to the organization's threat profile, including lures mimicking legitimate professional events.
Detection measures
- Enable Google Workspace's Advanced Protection Program for high-risk users such as researchers and executives to add additional authentication safeguards.
- Monitor authentication logs for anomalous sign-in locations, rapid token reuse, or session hijacking indicators that may signal an AitM compromise.
- Deploy a SIEM or UEBA solution to alert on impossible travel or concurrent session anomalies tied to user accounts.