Cisco Talos: AI-Assisted Phishing Campaign Targets Taiwan Research Institutions

Cisco Talos has identified an advanced persistent threat (APT) spear-phishing campaign targeting individuals affiliated with research organizations in Taiwan. The operation utilizes AI-assisted event lures to deliver real-time Account-in-the-Middle (AitM) phishing attacks.

The threat actors behind the campaign leveraged themes from legitimate public events to craft their lures. By impersonating reputable academic and policy institutions, the attackers sought to gain the trust of their targets. This approach allows the malicious actors to blend in with normal professional communications, making the phishing attempts more convincing.

Campaign Tactics and Technical Details

The core of this operation relies on sophisticated social engineering combined with modern technical capabilities. According to Cisco Talos, the group is delivering real-time Google AitM phishing. This technique typically involves an intermediary server that proxies the interaction between the victim and the legitimate service, allowing the attacker to capture session cookies and credentials in real time.

The use of AI-assisted tools suggests an evolution in how these threats are constructed. By automating aspects of the phishing infrastructure or content generation, the attackers can likely scale their operations or adapt quickly to changes in the target environment. The specific focus on event themes indicates that the threat actors are monitoring public calendars and announcements to time their attacks effectively.

Who Is Affected

The primary targets of this campaign are individuals affiliated with research organizations in Taiwan. This sector is often a target for state-sponsored or advanced threat groups due to the sensitive nature of the research being conducted. The campaign specifically impersonates academic and policy institutions, suggesting that the attackers have a deep understanding of the target demographic's professional interests and communication patterns.

Researchers, academics, and policy analysts in the region are the most vulnerable to these specific lures. The impersonation of reputable institutions adds a layer of credibility that can bypass standard user skepticism.

What should you do?

No specific patch or software update has been confirmed to address this specific phishing campaign, as it relies on social engineering and credential theft rather than a software vulnerability. Security teams should monitor for suspicious login attempts, particularly those originating from unusual locations or at unusual times.

Organizations should enforce multi-factor authentication (MFA) that is resistant to session hijacking, such as FIDO2 security keys, to mitigate the risk of AitM attacks. Users should be trained to verify the URL of any login page and to be wary of unsolicited invitations to academic or policy events.

Background: Social engineering

Look for urgency, secrecy, and deviation from standard channels. Verify identity through a separate, known communication path before acting. Isolate suspicious interactions immediately to prevent lateral movement within your network environment.

Read the full guide: Social Engineering Warning Signs and How to Respond

Frequently asked questions

Who is behind the UAT-11985 campaign?

Cisco Talos identified the campaign as an APT spear-phishing operation, but the specific identity of the threat actor group is not detailed in the summary.

What technique is used to steal credentials?

The attackers use AI-assisted Account-in-the-Middle (AitM) phishing, specifically targeting Google accounts.

Which organizations are targeted?

The campaign targets individuals affiliated with research organizations in Taiwan, impersonating academic and policy institutions.