UAT-11985 Exploits Fake Event Invites to Phish Taiwan Research Affiliates via Google AitM

UAT-11985 Exploits Fake Event Invites to Phish Taiwan Research Affiliates via Google AitM

A newly detailed advanced persistent threat (APT) campaign is leveraging seemingly innocuous event invitations to compromise Google accounts belonging to individuals affiliated with Taiwan research organizations. Tracked as UAT-11985, the operation employs an adversary-in-the-middle (AitM) phishing framework to bypass multi-factor authentication (MFA) and harvest credentials, according to a report published by The Hacker News.

The Lure: Fake Event Invitations

The campaign begins with spear-phishing emails that mimic legitimate event invitations. These messages are crafted to appear as though they come from trusted platforms or colleagues, enticing recipients to click on a link. Once clicked, victims are redirected to a phishing page that closely imitates Google's authentication interface. The use of event invites is a classic social engineering tactic: it exploits curiosity and the professional obligation to respond to invitations, lowering the victim's guard.

Adversary-in-the-Middle (AitM) Phishing

Unlike traditional phishing, which simply captures static credentials, AitM phishing places a proxy between the victim and the legitimate service. As the victim enters their username, password, and MFA code on the fake page, the attacker relays this information to Google in real time. The attacker then captures the session cookie issued by Google after successful authentication. This cookie allows the attacker to bypass MFA entirely, as the session is already authenticated. The technique is particularly dangerous because it defeats most forms of MFA, including SMS codes, authenticator apps, and even push notifications.

Targeting Taiwan Research Affiliates

The campaign specifically targets individuals affiliated with Taiwan research organizations. While the exact motive remains unclear, such targeting often aligns with espionage objectives, as research institutions may hold sensitive intellectual property or geopolitical insights. The APT's focus on Google accounts suggests an interest in email communications, cloud documents, and other Google Workspace data.

Technical Details and Infrastructure

The AitM phishing framework used by UAT-11985 is designed to be stealthy and scalable. The phishing pages are hosted on domains that appear legitimate, often using typosquatting or subdomain tricks to deceive victims. The framework also includes mechanisms to evade detection by security tools, such as blocking requests from known sandbox or crawler IP addresses. Additionally, the attackers likely use encrypted channels to exfiltrate stolen session cookies to command-and-control servers.

Implications for Defenders

The UAT-11985 campaign underscores the evolving sophistication of phishing attacks. Traditional security awareness training that focuses on spotting misspellings or suspicious sender addresses is insufficient against AitM techniques. Organizations must adopt phishing-resistant MFA, such as FIDO2 security keys, which bind authentication to the legitimate origin and cannot be relayed by a proxy. Additionally, monitoring for anomalous session activity—such as logins from unusual locations or devices shortly after a phishing email—can help detect compromised accounts.

Recommendations

• Deploy phishing-resistant MFA: Prioritize FIDO2/WebAuthn security keys over SMS or push-based MFA.
• Implement conditional access policies: Restrict access based on device compliance, location, and risk signals.
• User education: Train users to verify event invitations through separate channels and to hover over links before clicking.
• Email filtering: Use advanced threat protection to detect and block AitM phishing links.
• Session monitoring: Alert on session cookie reuse from different IP addresses or devices.

Conclusion

UAT-11985's use of fake event invites combined with AitM phishing represents a significant threat to research affiliates in Taiwan. As APTs continue to refine their tactics, defenders must move beyond password-based security and embrace phishing-resistant authentication to protect sensitive accounts. The disclosure serves as a reminder that even well-known services like Google are not immune to sophisticated impersonation.

For more details, refer to the original report: UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing.