UAT-11985: AI-assisted event lures delivering real-time Google AitM phishing

This APT spear-phishing campaign targeted individuals affiliated with Taiwan research organizations by impersonating legitimate institutions and leveraging publicly available event information. The threat actor used AI-assisted content generation to produce highly consistent and personalized phishing emails with a common social engineering template. The campaign also employed quishing by embedding malicious QR codes in legitimate event posters, expanding the attack surface beyond email recipients. The phishing infrastructure used a hybrid HTTP and WebSocket architecture to implement a real-time adversary-in-the-middle (AitM) attack that intercepted Google credentials and MFA challenges. The phishing pages visually mimicked legitimate Google Forms and login pages, with deceptive hyperlinks concealing the true malicious destinations. Linguistic and localization analysis suggests the phishing kit was developed primarily in Simplified Chinese and later localized. The campaign demonstrates sophisticated multi-vector social engineering and technical phishing techniques.

The campaign enables credential theft including multi-factor authentication tokens through a real-time adversary-in-the-middle phishing framework, potentially compromising user accounts and sensitive information. The use of AI-assisted content generation increases the scale and personalization of spear-phishing, raising the likelihood of successful victim engagement. The addition of quishing extends the attack vector to physical environments, potentially affecting secondary victims who scan malicious QR codes on printed materials. The impersonation of reputable institutions and use of legitimate event details increases the credibility of the phishing lures, making detection by recipients more difficult.

No official patch or fix applies as this is a social engineering and phishing campaign. Organizations should educate users about the risks of spear-phishing and quishing, emphasizing verification of sender identities and caution with hyperlinks and QR codes in unsolicited communications. Users should verify event invitations directly with purported organizers through independent channels. Multi-factor authentication remains important but may be bypassed by this advanced AitM phishing technique, so additional monitoring and anomaly detection on accounts is recommended. Cisco Talos has not indicated that the phishing infrastructure is mitigated or taken down; vigilance and user awareness are key defenses.