As reported by The Hacker News, Cisco Talos has published details on UAT-11985, an APT actor targeting Taiwan-affiliated research organizations through a sophisticated spear-phishing campaign that combines adversary-in-the-middle (AitM) credential harvesting with AI-assisted lure generation. The campaign, active since mid-2026, impersonates legitimate Taiwanese academic institutions and uses fake event invitations to lure victims into surrendering Google credentials and MFA codes.

Threat Intelligence: As reported by The Hacker News, Cisco Talos has published details on UAT-11985, an APT actor targeting Taiwan-affiliated research organizations through a sophisticated spear-phishing campaign that combines adversary-in-the-middle (AitM) credential harvesting with AI-assisted lure generation.

Why This Campaign Matters Beyond Taiwan

While the targeting is geographically focused, the tradecraft UAT-11985 demonstrates has implications for every organization that relies on MFA as a primary authentication control. The AitM phishing technique is not new, but its pairing with AI-generated, reusable prompt templates represents a meaningful escalation in operational efficiency. Traditionally, spear-phishing at this quality required human operators to research targets and handcraft each lure. UAT-11985's use of a near-identical three-part email structure across disparate geopolitical topics strongly suggests a templated AI generation pipeline — enabling a small team to produce convincing, personalized phishing at scale.

The industrialization of spear-phishing through AI-assisted content generation collapses the cost barrier between mass phishing and targeted attacks. Defenders can no longer rely on grammatical errors, inconsistent formatting, or generic messaging as reliable phishing indicators.

The campaign's incorporation of QR code phishing ("quishing") by modifying legitimate event posters with malicious QR codes is particularly noteworthy. This extends the attack surface well beyond email recipients to anyone who encounters printed or redistributed event materials — a vector that most email security stacks are not designed to address.

Who Is at Risk

Who Is at Risk
Academic and research institutions — particularly those involved in geopolitics, policy, or international relations, where public event attendance is common and expected.
Government-adjacent organizations — think tanks and policy institutes whose personnel frequently receive legitimate event invitations from unknown senders.
Any organization using SMS- or TOTP-based MFA — AitM phishing kits transparently relay MFA prompts, making push-based and time-based codes equally vulnerable.
Google Workspace environments — the campaign specifically targets Google account authentication, which is ubiquitous across academic and research sectors.

The AitM Threat and MFA's False Comfort

The core technical concern is that AitM phishing frameworks operate as real-time reverse proxies. When a victim enters credentials and MFA codes on the attacker's spoofed page, the framework forwards them to the legitimate service in real time, captures the resulting session token, and persists access even after the victim completes authentication. This means MFA is bypassed at the point of entry — not broken — but the session that results is fully compromised.

Organizations that treat MFA enrollment as a compliance checkbox rather than a layered control are operating with a false sense of security. Phishing-resistant MFA — specifically FIDO2/WebAuthn hardware keys or platform authenticators with device-bound credentials — is the only MFA modality that meaningfully resists AitM attacks, because these methods cryptographically bind authentication to the legitimate origin domain.

Shield53 Recommendations

  • Migrate to phishing-resistant authentication. Prioritize FIDO2/WebAuthn hardware security keys (YubiKey, Titan) or platform authenticators (Windows Hello, Touch ID) for high-risk personnel. SMS, email-based, and TOTP MFA are all vulnerable to AitM relay.
  • Deploy conditional access policies that restrict Google Workspace sign-ins to managed devices and expected geographic regions, reducing the value of stolen session tokens.
  • Implement URL rewriting and time-of-click analysis in email security gateways. Hover-preview spoofing (where a malicious URL displays a legitimate-looking destination on hover) requires deeper inspection than traditional link scanning provides.
  • Train staff on QR code phishing. Quishing bypasses email-based URL scanning entirely. Advise personnel to verify QR codes on event materials through official institutional channels before scanning.
  • Monitor for session token abuse. Deploy detection for impossible travel scenarios, new device enrollments, and anomalous Google Workspace API access patterns that may indicate token replay.
  • Validate sender identity for event invitations. Cross-reference event details against official institutional websites rather than trusting email sender display names, which are trivially spoofed.

The UAT-11985 campaign is a preview of the post-2026 phishing landscape: AI-generated lures that are indistinguishable from legitimate communications, AitM kits that neutralize conventional MFA, and attack vectors that extend beyond the inbox into the physical world. Defenders must assume that phishing will succeed and build detection and response capabilities around session-level compromise, not just credential theft.