UAT-11985 used AI-written lures and an AitM phishing kit in a Taiwan spear-phishing campaign that steals Google logins and bypasses MFA.
#UAT11985 #AitMPhishing #CiscoTalos #SpearPhishing #Quishing #Taiwan #MFABypass #Cybersecurity
#UAT11985 #AitMPhishing #CiscoTalos #SpearPhishing #Quishing #Taiwan #MFABypass #Cybersecurity
UAT-11985 Uses AI-Written Lures and an AitM Phishing Kit Against Taiwan Researchers
At a glance Actor UAT-11985 (tracked by Cisco Talos) Activity Spear-phishing, QR code phishing (quishing), and AitM credential theft Targets People affiliated with Taiwan research organizations Scale Not disclosed; Talos analyzed three lure emails Status No law-enforcement action reported Source Cisco Talos research report TL;DR Cisco Talos found a spear-phishing campaign against people linked to Taiwan research groups in mid-2026. The actor, UAT-11985, sent fake event invitations that led to an AitM phishing kit built to steal Google logins and MFA codes.
securityonline.info
October 12, 2026 at 6:20 AM
UAT-11985 used AI-written lures and an AitM phishing kit in a Taiwan spear-phishing campaign that steals Google logins and bypasses MFA.
#UAT11985 #AitMPhishing #CiscoTalos #SpearPhishing #Quishing #Taiwan #MFABypass #Cybersecurity
#UAT11985 #AitMPhishing #CiscoTalos #SpearPhishing #Quishing #Taiwan #MFABypass #Cybersecurity
UAT-11985 relays Google logins and MFA live via fake event invites and tampered QR posters. https://intel.threadlinqs.com/threat/TL-2026-3205 #ThreatIntel #HtmlPhishingUAT11985100606140 #WebSocketbased #UAT11985
October 10, 2026 at 4:53 AM
UAT-11985 relays Google logins and MFA live via fake event invites and tampered QR posters. https://intel.threadlinqs.com/threat/TL-2026-3205 #ThreatIntel #HtmlPhishingUAT11985100606140 #WebSocketbased #UAT11985
@talosintelligence.com
APT campaign uses AI-crafted lures, quishing and real-time Google AitM to steal credentials, MFA and sessions.
-
IOCs: UAT-11985, Html[.]Phishing[.]UAT11985-10060614-0, Snort SID 1:67198
-
#AitM #Phishing #ThreatIntel
APT campaign uses AI-crafted lures, quishing and real-time Google AitM to steal credentials, MFA and sessions.
-
IOCs: UAT-11985, Html[.]Phishing[.]UAT11985-10060614-0, Snort SID 1:67198
-
#AitM #Phishing #ThreatIntel
AI-Assisted Google AitM Phishing
blog.talosintelligence.com
October 8, 2026 at 12:43 PM
@talosintelligence.com
APT campaign uses AI-crafted lures, quishing and real-time Google AitM to steal credentials, MFA and sessions.
-
IOCs: UAT-11985, Html[.]Phishing[.]UAT11985-10060614-0, Snort SID 1:67198
-
#AitM #Phishing #ThreatIntel
APT campaign uses AI-crafted lures, quishing and real-time Google AitM to steal credentials, MFA and sessions.
-
IOCs: UAT-11985, Html[.]Phishing[.]UAT11985-10060614-0, Snort SID 1:67198
-
#AitM #Phishing #ThreatIntel