UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing
Advanced persistent threat campaign targets Taiwan research organizations with AI-generated phishing emails and AitM framework to harvest Google credentials and MFA codes.
Intelligence analysis by Qwen 2.5 (3B)
Cybersecurity researchers have disclosed details of an APT spear-phishing campaign targeting Taiwan research organizations, using AI-generated content and AitM phishing framework to steal Google account credentials and MFA codes.
A bad guy sent fake invitations to a real event. They tricked people into clicking on a link and gave them fake Google forms. The forms tried to get people to give their Google passwords. The bad guy used a trick to get the real Google to send the passwords to them.
Analysis
{"
Event Structure and Impersonation Tactics":-1.11985,"UAT-11985":"By deliberately splitting one-shot uploads with POST requests from low-latency state updates with WebSocket connection, the threat actor has engineered a seamless credential-harvesting relay. This allows the threat actor to mirror Google's dynamic authentication state in real time, ultimately achieving full account takeover without raising the victim's suspicion.","Joey Chen, Talos researcher":"The spoofed Google login panels only support Simplified Chinese (zh-CN), Traditional Chinese (zh-TW), and English locales, with region detection based on the victim's browser 'navigator.languages,' strongly suggesting targeting of Chinese-speaking users.","
Content Generation and Personalization":-1.11985,"
AitM Framework and Credential Harvesting":-1.11985,"
Targeting and Localization":-1.11985}
Key points
- The campaign used AI to create fake event invitations and phishing emails.
- The phishing emails impersonated legitimate Taiwan-based institutions.
- The bad guy used a technique called AitM to steal Google account credentials.
- The fake Google forms tricked people into giving their passwords.
- The bad guy used a WebSocket connection to get the real Google to send the passwords.
With better security measures, the bad guys might not be able to trick as many people.
Even with better security, some people might still fall for the trick.
