# UAT-11985: AI-Assisted AitM Phishing Targets Taiwan Research

> Runtime Rebel details UAT-11985, an APT campaign using AI-assisted spear-phishing and Google AitM techniques to target Taiwan research organizations, bypassing MFA.

- Published: 2026-10-08T15:07:38.000Z
- Severity: medium
- Category: Threat Intel
- Tags: APT, Phishing, AitM, UAT 11985, AI Assisted
- Author: Runtime Rebel Intel
- Primary source: https://blog.talosintelligence.com/uat-11985/
- Canonical: https://runtimerebel.com/blog/uat-11985-ai-assisted-aitm-phishing-targets-taiwan-research

## Key points

- APT campaign UAT-11985 uses AI-assisted phishing and Google AitM to steal credentials and bypass MFA from Taiwan research organizations.
- Individuals affiliated with Taiwan research institutions are targeted via sophisticated spear-phishing emails and malicious QR codes.
- Prioritize enhanced phishing awareness training and advanced email filtering capable of detecting AitM attacks.

## UAT-11985: [AI](/glossary#ai)-Assisted AitM [Phishing](/glossary#phishing) Campaign Targets Taiwan Research

Cisco Talos has uncovered an advanced persistent threat ([APT](/glossary#apt)) campaign, designated UAT-11985, employing sophisticated **AI-assisted event lures** and adversary-in-the-middle (AitM) phishing techniques. This operation specifically targets individuals affiliated with Taiwan research organizations, aiming to compromise credentials and bypass multi-factor authentication ([MFA](/glossary#mfa)). The campaign's tactics demonstrate a high degree of personalization and technical sophistication, signaling a significant threat to geopolitical research sectors, according to [Cisco Talos](https://blog.talosintelligence.com/uat-11985/).

### Technical Analysis of AI-Assisted Phishing Lures

The UAT-11985 actors leverage legitimate public event themes and impersonate reputable academic and policy institutions in Taiwan, such as the Taiwan European Union Centre, NCCU Institute of International Relations, and Taiwan Research Institute. The phishing emails exhibit highly consistent structure, rhetoric, and personalization patterns, strongly suggesting the use of AI-assisted content generation. While Talos cannot conclusively determine full Large Language Model ([LLM](/glossary#jailbreak-llm)) generation, the evidence points to reusable prompt templates and rapid customization capabilities.

Key characteristics of these lures include:

*   **Impersonation and Legitimacy Laundering**: The actors fabricate sender identities while exploiting legitimate organizational names and public event details to establish credibility. This involves displaying benign-looking URLs that, upon clicking, redirect to malicious phishing sites.
*   **Consistent Structure and Rhetoric**: Emails follow a three-part structure. The opening section uses elaborate, vague geopolitical jargon like “global strategic landscape” to project academic authority. The middle section employs targeted flattery, using generic compliments such as “authoritative perspective” to encourage engagement, customized using publicly available professional information.
*   **Deceptive Registration Mechanisms**: Embedded registration links appear to lead to legitimate services (e.g., Google Forms) but conceal underlying malicious `href` attributes, directing victims to actor-controlled infrastructure.

Beyond traditional email, the campaign also incorporates QR code phishing, or "quishing," by modifying legitimate event posters with malicious QR codes. This expands the [attack surface](/glossary#attack-surface) to secondary victims who might encounter printed materials.

### Advanced Adversary-in-the-Middle (AitM) Framework

A core component of UAT-11985 is an advanced AitM phishing framework designed to impersonate Google authentication pages. This framework utilizes a hybrid HTTP and WebSocket architecture to synchronize authentication workflows in real time, effectively intercepting credentials and MFA challenges. This allows the threat actors to bypass common MFA protections, a critical capability for advanced persistent threats.

Analysis of the phishing kit revealed that its user interface was likely developed initially in Simplified Chinese, later adapted for Traditional Chinese and English. This, along with lexical usage patterns, suggests a developer whose primary working language is Simplified Chinese, providing moderate confidence in the actor's origin.

### Actionable Recommendations for Google AitM Phishing Mitigation

Given the sophistication of this **APT spear-phishing targeting Taiwan research** organizations, defenders must implement multi-layered defenses:

*   **Enhanced [Security Awareness Training](/glossary#security-awareness-training)**: Educate users on the evolving tactics of AI-assisted phishing. Emphasize vigilance against emails that use excessive flattery, generic jargon, or inconsistent sender information, even if they appear to originate from known institutions. Train users to scrutinize URLs carefully, noting discrepancies between displayed and actual links.
*   **Implement Advanced Email and Web Filtering**: Deploy security solutions capable of detecting sophisticated phishing attempts, including those using AitM techniques and URL manipulation. Such solutions should inspect link destinations rather than just displayed text.
*   **Strengthen Authentication Protocols**: While AitM can bypass MFA, organizations should still enforce strong, phishing-resistant MFA methods where possible. Furthermore, monitor for unusual login attempts or authentication anomalies that might indicate an AitM attack in progress.
*   **QR Code Vigilance**: Advise employees to exercise caution when scanning QR codes from public or unverified sources. Always verify the authenticity of event posters or materials before engaging with embedded QR codes.
*   **Incident Response Planning**: Establish clear procedures for reporting suspicious emails or potential compromises. Rapid reporting and response are crucial for containing the impact of such sophisticated attacks. Organizations should specifically review their strategies for **Google AitM phishing mitigation** to counter real-time [credential theft](/glossary#credential-theft).

**Related:** [Evilginx Operations Exposed: Misconfigured Server Leaks M365 Phishing Kits](/blog/evilginx-operations-exposed-misconfigured-server-leaks-m365-phishing-kits), [Zimbra Zero-Click Exploitation by Russian APT for Email Theft](/blog/zimbra-zero-click-exploitation-by-russian-apt-for-email-theft)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/uat-11985-ai-assisted-aitm-phishing-targets-taiwan-research