UAT-11985 Targets Taiwan Research Affiliates With Fake Event Invites and Google AitM Phishing

What Happened

Security researchers have disclosed an advanced persistent threat (APT) spear-phishing campaign, tracked as UAT-11985, targeting individuals affiliated with Taiwan-based research organizations. According to the report, attackers used fake event invitations as a lure to direct victims to an adversary-in-the-middle (AitM) phishing framework designed to harvest Google account credentials and multi-factor authentication (MFA) codes.

Why It Matters

AitM phishing kits are designed specifically to defeat MFA by proxying a live authentication session between the victim and the real service, capturing session tokens rather than just passwords. For research institutions in Taiwan — a region of frequent geopolitical and espionage interest — compromise of Google accounts can expose sensitive research communications, collaborator networks, and credentials that may enable further lateral movement or follow-on targeting of affiliated organizations. The use of a believable social lure (event invitations) suggests the operators are investing in tailored social engineering against a specific affiliate community rather than broad, opportunistic phishing.

What Defenders Should Watch For

• Treat unsolicited event/conference invitation emails to research staff with heightened scrutiny, especially those urging quick action or credential re-entry.
• Monitor for anomalous Google Workspace/account sign-ins following link clicks — AitM frameworks produce session token theft, so watch for session reuse from unfamiliar IPs or devices shortly after a user interacts with a suspicious link.
• Review authentication logs for impossible-travel or device-mismatch patterns on accounts tied to research or academic affiliates.
• Consider hardware-backed or FIDO2/WebAuthn phishing-resistant MFA where feasible, since AitM proxies are effective against OTP and push-based MFA.
• Educate at-risk personnel (researchers, affiliates with Taiwan-linked institutions) on verifying invitation senders and domains before authenticating.

Developing Intel

Details on UAT-11985's infrastructure, specific lure domains, and full scope of victims are still emerging, and this write-up reflects what has been publicly reported so far. For the original reporting, see The Hacker News.