UAT-11985 Uses AI-Crafted Event Lures to Hijack Google Accounts and Bypass MFA
George antony 
Cisco Talos has uncovered an APT spear-phishing campaign against Taiwan research organizations. The campaign pairs polished, probably AI-assisted invitations with a real-time Google adversary-in-the-middle (AitM) kit that captures passwords and MFA challenges as victims type them.
UAT-11985 is a threat actor reportedly using AI-generated event invitations to target users. These invitations are designed to look genuine and encourage victims to interact with malicious content.
Artificial intelligence can help attackers create convincing and personalized messages. The campaign aims to gain unauthorized access to Google accounts.
Lures to Hijack Google Accounts and Bypass MFA
Users should verify event invitations before clicking links or entering login details. Avoid approving unexpected authentication requests or sharing verification codes.
Use phishing-resistant security keys or passkeys wherever possible. Organizations should monitor suspicious sign-ins and revoke unauthorized sessions promptly.
In mid-2026, Talos observed emails targeting people affiliated with Taiwan-based research bodies. The sender identities were fabricated, but the cover was real.
The actor impersonated the Taiwan European Union Center, the NCCU Institute of International Relations and the Taiwan Research Institute. It reused genuine public event details to lend authority. When one recipient contacted the named institutions, none could confirm that the senders worked for them.
All three emails followed the same three-part structure. An elaborate opening on geopolitics leaned on vague phrases such as “reshaping the great-power order.”
The middle section flattered the recipient’s “authoritative perspective” and offered VIP seating. The closing section listed logistics copied from legitimate announcements. Talos could not prove a large language model wrote the messages. It still sees strong evidence of AI-assisted production from a reusable prompt template.
The registration links hid their real destination. One showed a believable Google Forms address, while the underlying href led to a phishing site on a third-party platform.
Some emails also carried event posters scraped from legitimate sites, with the QR codes swapped for malicious ones. The actor may have expected recipients to print the posters and pin them on office boards. That would draw in colleagues who never received the email, turning quishing into a physical-world vector.
Victims land on a fake Google Form that forces a redirect to a spoofed Google login page. The page supports Simplified Chinese, Traditional Chinese and English, chosen from the browser’s navigator.languages value.
A hidden section holds a sandboxed iframe, google-success-frame, that simulates a successful sign-in. Obfuscated JavaScript sits at the end of the page. It relies on a large Base64 string array shuffled at runtime by a push/shift loop, which defeats many automated deobfuscation tools.
The kit uses two channels. HTTP POST sends one-shot data to the command server: browser fingerprints, credentials, challenge responses and heartbeat polls. A persistent WebSocket carries live instructions back, telling the page which screen to show next.
The flow starts with a google_login_start request that reports locale, user agent, screen size, and mobile status. The victim then enters an email or phone number, which the actor’s server relays to real Google to check whether the account exists and whether passkeys are enabled.
The page then shows either a password prompt or a passkey screen. A submitted password goes out through google_login_check and is forwarded to Google.
If Google demands more proof, the server returns the MFA type and layout, and the WebSocket moves the victim to the matching step.
Talos says this lets the actor bypass MFA and harvest fully authenticated session tokens, enabling account takeover. The design appears operator-driven rather than fully automated.
Talos assesses with moderate confidence that the developer’s primary language is Simplified Chinese. The base translation object is written in Simplified Chinese and assigned to zh-CN.
It generates the Traditional Chinese and English versions at runtime from it. Mainland-style terms such as “账号,” “计算机” and “邮箱” reinforce that view, and the code consistently falls back to Simplified Chinese.
Talos also notes a separate JWR phishing framework report with similar WebSocket techniques, though the strategies differ.
Treat unexpected event invitations from unverifiable senders with suspicion, even when the details check out against public pages. Hover over links to inspect the real destination before clicking.
Scan posters and QR codes only from trusted sources. Because this kit relays live sessions, defenders should favor phishing-resistant authentication and watch for unusual session-token use after sign-ins.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
