Threat intel
UAT-11985 Targets Taiwan Research Affiliates With Fake Event Invites and Google AitM Phishing
An APT group tracked as UAT-11985 is using fake event invitations in a spear-phishing campaign against people affiliated with Taiwanese research organizations, luring them to an adversary-in-the-middle phishing framework that steals Google account credentials and MFA codes, The Hacker News reported.
Cybersecurity researchers have disclosed a spear-phishing campaign by an advanced persistent threat (APT) group tracked as UAT-11985 that targets individuals affiliated with research organizations in Taiwan, The Hacker News reported.
According to the report, the attackers use fake event invitations as lures to direct victims to an adversary-in-the-middle (AitM) phishing framework. The operation is designed to harvest victims' Google account credentials as well as their multi-factor authentication (MFA) codes.
AitM phishing works by placing a malicious proxy between the victim and the legitimate service they are trying to reach. When a target enters login details on what appears to be a genuine sign-in page, the proxy relays the traffic to the real service while silently capturing the credentials. Because the proxy sits inside the live authentication session, it can also intercept one-time codes or session tokens in real time, allowing attackers to bypass MFA protections that would otherwise stop simple password theft.
The campaign's focus on people connected to Taiwanese research institutions is consistent with the kind of espionage-motivated activity typically associated with APT groups, where threat actors seek access to email accounts and the sensitive communications or files they contain. By combining a convincing social-engineering lure — an invitation to an event — with infrastructure capable of defeating MFA, the attackers raise their chances of compromising high-value accounts.
The disclosure underscores the continued risk that AitM phishing frameworks pose, even to users who have enabled multi-factor authentication. Security teams generally advise organizations to consider phishing-resistant authentication methods, such as hardware security keys, and to treat unsolicited event invitations with caution.
Source: The Hacker News
