[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fGqOcd-w54Qol1N3QKxlXnm9yoX6i4FthBu9PQt7ulTM":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":23,"status":24,"created_at":25,"published_at":26,"article":27,"tags":31,"podcasts":44,"controls":51},"331b38e9-1d91-4544-9e49-c283036dbd40","aitm-phishing-campaign-bypasses-mfa-to-steal-google-credentials-from-taiwan-researchers","e805c86a-03fe-4b0e-9d72-9d4fa74a743b","AitM Phishing Campaign Bypasses MFA to Steal Google Credentials from Taiwan Researchers","The UAT-11985 campaign demonstrates how sophisticated threat actors use socially engineered spear-phishing lures — in this case, fake event invitations — to trick targeted individuals into surrendering credentials and MFA codes via an adversary-in-the-middle (AitM) framework. AitM attacks are particularly dangerous because they defeat traditional MFA by proxying the authentication session in real time, rendering SMS and TOTP-based MFA ineffective. Research institutions are high-value targets for nation-state actors due to their access to sensitive intellectual property and government-adjacent data. This attack underscores that even security-conscious users can be deceived by contextually relevant lures, and that MFA alone is not a silver bullet against advanced phishing techniques.","**Immediate actions:**\n- Train staff to verify event invitations through official channels before clicking any embedded links.\n- Migrate Google Workspace accounts to phishing-resistant MFA such as FIDO2\u002Fpasskeys or hardware security keys, which cannot be intercepted by AitM frameworks.\n\n**Long-term improvements:**\n- Implement a Zero Trust architecture requiring continuous verification of user identity and device posture before granting access to sensitive resources.\n- Establish strict email filtering rules and link-rewriting policies that flag or sandbox unexpected external invitations and redirect URLs.\n- Conduct regular spear-phishing simulations tailored to the organization's threat profile, including lures mimicking legitimate professional events.\n\n**Detection measures:**\n- Enable Google Workspace's Advanced Protection Program for high-risk users such as researchers and executives to add additional authentication safeguards.\n- Monitor authentication logs for anomalous sign-in locations, rapid token reuse, or session hijacking indicators that may signal an AitM compromise.\n- Deploy a SIEM or UEBA solution to alert on impossible travel or concurrent session anomalies tied to user accounts.",[12,13,14,15,16,17,18,19,20,21,22],"CIS Control 9: Email and Web Browser Protections","CIS Control 14: Security Awareness and Skills Training","CIS Control 6: Access Control Management","NIST SP 800-63B: Digital Identity Guidelines (Phishing-Resistant AAL3)","NIST AC-17: Remote Access","NIST SI-3: Malicious Code Protection","NIST AT-2: Literacy Training and Awareness","MITRE ATT&CK T1557: Adversary-in-the-Middle","MITRE ATT&CK T1566.002: Spearphishing Link","ISO\u002FIEC 27001 A.8.5: Secure Authentication","GDPR Article 32: Security of Processing (for EU-affiliated research data)",{},"published","2026-10-16T18:21:24.463359+00:00","2026-10-16T18:21:24.446+00:00",{"id":7,"url":28,"slug":29,"title":30},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fuat-11985-uses-fake-event-invites-to.html","uat-11985-uses-fake-event-invites-to-target-taiwan-research-affiliates-with-goog-23e482","UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing",[32,38],{"id":33,"name":34,"slug":35,"description":36,"color":37},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":39,"name":40,"slug":41,"description":42,"color":43},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",[45],{"id":46,"date":47,"edition":48,"title":49,"audio_url":50},"db466008-af33-4c69-a4f3-3063e4a21903","2026-10-17","morning","ThreatNoir Weekend Brief — October 17","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-10-17\u002Fthreatnoir-morning-brief-2026-10-17.mp3",[52,56,60],{"slug":53,"name":54,"problem":55},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":57,"name":58,"problem":59},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",{"slug":61,"name":62,"problem":63},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them."]