UAT-11985 Campaign Targets Taiwan Researchers via AitM Phishing
Sophisticated threat actors leverage AI-generated lures and AitM proxies to bypass MFA.
1Sophisticated Spear-Phishing Campaign
The UAT-11985 threat actor is targeting individuals affiliated with Taiwan research organizations through highly coordinated spear-phishing operations. First observed in mid-2026, the campaign utilizes AI-assisted content generation to mass-produce convincing lures. These emails impersonate reputable academic institutions, such as the Taiwan European Union Centre, to establish credibility and deceive targets.
2AI-Driven Content Generation
The threat actor employs a reusable prompt template to maintain consistent syntactic structures across diverse geopolitical topics. By automating the creation of personalized flattery and institutional impersonation, the attacker scales their outreach efforts. This approach suggests a coordinated strategy rather than independent attacks, allowing for rapid deployment of bespoke phishing lures.
3QR Code Manipulation Tactics
Beyond traditional email vectors, the campaign incorporates quishing techniques by modifying legitimate event posters. Attackers scrape authentic event materials from public websites and replace original QR codes with malicious versions. This strategy expands the attack surface to secondary victims who encounter printed materials, bypassing standard email security filters and gateways.
4Adversary-in-the-Middle Framework
The core of the operation involves an AitM proxy that mimics legitimate Google Forms. When victims attempt to register, they are redirected to a spoofed login panel. This infrastructure uses obfuscated JavaScript to capture credentials and MFA codes in real-time, forwarding them to actual Google authentication servers to maintain session persistence.
5Real-Time Credential Exfiltration
The AitM proxy utilizes a WebSocket connection to exfiltrate sensitive data immediately upon entry. Before the connection is established, the payload collects device metadata, including user agents and screen dimensions, via a google_login_start request. This granular reconnaissance ensures the attacker can mirror Google’s dynamic authentication state without triggering victim suspicion.
6Technical Execution and Locales
The phishing pages are specifically localized to support Simplified Chinese, Traditional Chinese, and English. By analyzing the victim's browser navigator.languages settings, the attacker ensures a tailored experience. The separation of POST requests for credential uploads and WebSocket connections for state updates creates a seamless relay that facilitates full account takeover.
7Institutional Impersonation Strategy
The campaign targets specific entities like the NCCU Institute of International Relations and the Taiwan Research Institute. By fabricating sender identities and leveraging public event themes, the actor increases the likelihood of engagement. This focus on high-value research affiliates highlights the strategic intent to compromise sensitive academic and policy-related accounts.
8Implications for Identity Security
The UAT-11985 campaign demonstrates the evolving threat landscape where AI accelerates reconnaissance and identity compromise. Security teams must implement robust runtime identity controls to detect unauthorized access attempts. As attackers refine their ability to bypass MFA through AitM proxies, organizations must prioritize proactive monitoring of authentication flows to mitigate breach risks.
Original article: The Hacker News — UAT-11985 Campaign Targets Taiwan Researchers via AitM Phishing