Cisco Talos Tracks UAT-11985 Campaign Bypassing Google MFA via AI-Like Lures
Researchers identify a spear-phishing operation using AI-assisted event invitations to steal credentials from Taiwanese research affiliates by intercepting Google authentication sessions.
Key points
- The campaign, tracked as UAT-11985, targets individuals linked to Taiwanese research organizations using sophisticated social engineering techniques.
- Attackers combine likely AI-generated text with real-time authentication interception to bypass multi-factor security controls on Google accounts.
- Fraudulent materials include altered QR codes on posters and spoofed login pages that mimic legitimate institutional event registration forms.
Cisco Talos researchers have identified an advanced persistent threat campaign designated UAT-11985 that is stealing Google account credentials from professionals affiliated with Taiwanese research organizations. The operation combines likely artificial intelligence-assisted spear-phishing emails with real-time authentication interception to bypass multi-factor security measures. According to GBHackers, the attackers use institutional impersonation and an adversary-in-the-middle framework to capture both login details and active authenticated sessions.
The campaign relies on a three-part email structure featuring geopolitical commentary, personalized praise, and event registration instructions. Talos noted strong evidence of AI-assisted production due to repetitive syntax and interchangeable compliments, though they could not conclusively prove large language model generation. Attackers repurposed legitimate public event information to create credible fraudulent invitations, exploiting recipients’ professional standing through references to exclusive participation and reserved seating.
Technical Tactics and Infrastructure
The phishing infrastructure is designed to mimic legitimate Google services closely. One hyperlink appeared to lead to a legitimate Google Forms address but actually directed victims to a phishing site hosted on a third-party platform. The malicious registration page initially imitated Google Forms before forcibly redirecting visitors to a counterfeit Google sign-in interface. Cisco Talos researchers observed that these spoofed login panels support only Simplified Chinese, Traditional Chinese, and English locales, with region detection based on the victim’s browser settings.
Attackers also distributed printed materials to extend the deception. They copied authentic event poster designs and replaced the original QR codes with malicious ones. Talos assessed that these altered posters, which might appear on office bulletin boards, could expose additional victims who scan the codes without verifying the destination. When recipients contacted the impersonated institutions, none could verify that the purported senders were employees or authorized representatives.
Targeted Organizations and Indicators
The operation has impersonated several specific entities to gain trust from its targets. According to Cisco Talos, the campaign impersonated the Taiwan European Union Centre, the NCCU Institute of International Relations, and the Taiwan Research Institute. Despite the changing topics and institutional names, the underlying structure of the lures remained consistent. Authentic dates, venues, and event descriptions provided credibility to the fraudulent invitations, making them difficult for recipients to distinguish from legitimate communications without careful inspection of links and sender verification.
What should you do?
Organizations should monitor for unusual login activity and verify the authenticity of event invitations through official channels before clicking links or scanning QR codes. Users should inspect the actual URL behind any hyperlink and ensure it matches the expected domain. Security teams should review browser locale settings and monitor for unexpected redirects to counterfeit login pages. Once the vendor provides an update or additional indicators, implement strict filtering rules for these specific phishing domains.
Background: Large language models
Large language models are a specific type of neural network trained on text. Generative AI is the broader umbrella term for any system that creates new content, including images and code. Not all generative AI uses large language models, but most modern text generators do.
What to do and how to stay safe: Cisco Talos
- Verify event invitations by contacting the organizing institution through known, official contact methods rather than using links provided in the email.
- Inspect the destination URL of any hyperlink before clicking, ensuring it matches the legitimate service provider and not a third-party hosting platform.
- Avoid scanning QR codes from unverified physical posters or bulletin boards, as these can lead to malicious phishing sites designed to steal credentials.
- Monitor account activity for unexpected logins or session hijacking attempts, and enable alerts for new device sign-ins to detect unauthorized access quickly.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which organizations are being targeted by this campaign?
The campaign targets individuals affiliated with Taiwanese research organizations, including those linked to the Taiwan European Union Centre and NCCU Institute of International Relations.
How are attackers bypassing multi-factor authentication?
Attackers use an adversary-in-the-middle phishing framework to intercept Google authentication in real-time, allowing them to steal credentials and authenticated sessions simultaneously.
Is the phishing content definitely generated by AI?
Talos found strong evidence of AI-assisted production but could not conclusively establish that a large language model generated the messages, noting that fluent prose supports assessment but not definitive attribution.
