As cited
Copy frozen at (site build).
threat intel
UAT-11985: AI-assisted event lures delivering real-time Google AitM phishing
Cisco Talos documented an advanced persistent threat (APT) campaign targeting Taiwan research organizations using artificial intelligence (AI)-assisted phishing emails impersonating legitimate academic institutions, combined with QR code manipulation on event posters. The threat actors deployed a sophisticated adversary-in-the-middle (AitM) phishing kit that impersonated Google authentication pages and used real-time WebSocket connections to intercept credentials and multifactor authentication (MFA) responses, enabling account takeover. Technical analysis of the phishing framework indicates the developer was a native Simplified Chinese speaker, suggesting a mainland Chinese origin.
Why it matters: Taiwan-based researchers and staff at academic institutions are immediate targets for credential theft and account compromise via this campaign; practitioners should alert personnel at affected organizations (Taiwan European Union Centre, NCCU Institute of International Relations, Taiwan Research Institute) to avoid clicking event invitation links and to verify events directly with institutions, and implement detection for the provided ClamAV and SNORT signatures.
- Source published
- First seen by Cybersecurity Tracker