UAT-11985 phishes Taiwan researchers with Google AitM kit

Cisco Talos has detailed a spear-phishing campaign it tracks as UAT-11985, aimed at people affiliated with Taiwan research organizations and built around a real-time adversary-in-the-middle (AitM) kit that proxies Google logins to steal passwords, MFA codes and authenticated session tokens. Talos published the research on October 8; there is no CVE here. This is credential interception, not a flaw in Google's services.

Attribution — as Talos frames it

Talos does not name a group. It assesses "with moderate confidence" that the kit developer's primary working language is Simplified Chinese, from the localization architecture and mainland-style terminology; the spoofed login panel supports only zh-CN, zh-TW and English, picked from the browser's language settings. Keep that framing — UAT- denotes an unattributed cluster, not an officially attributed state actor, and no indictment or sanction ties the activity to a government.

The lure and the kit

The emails impersonate real institutions — the Taiwan European Union Centre, the NCCU Institute of International Relations, and the Taiwan Research Institute — and follow a reusable three-part template: geopolitical framing, recipient-tailored flattery, then event logistics. Links render a legitimate-looking Google Forms URL on hover but resolve to attacker infrastructure, where a fake Google Form pops a spoofed sign-in. Talos also found quishing: malicious QR codes swapped onto otherwise legitimate event posters, a vector that can reach secondary victims off printed material, not just inboxes.

The phishing page sits between the victim and Google's real authentication servers. It runs a dual-channel design — HTTP POST for one-shot uploads (device fingerprints, credentials, challenge responses, heartbeats) and a persistent WebSocket that drives, in real time, which MFA screen to show. That is what defeats MFA and harvests session tokens. The JavaScript is obfuscated with string rotation and control-flow flattening.

Talos cannot prove an LLM wrote the lures, but strongly suspects AI-assisted generation from a reusable prompt template, citing the consistent structure, formulaic rhetoric and rapid per-target personalization across samples. Treat that as a hypothesis, not a finding.

Indicators of compromise

Published by Talos (verbatim, defanged as released):

https[:]//google.morelessty[.]com
https[:]//jmlh.morelessty[.]com/
https[:]//google.centerhoti[.]com/
https[:]//google.natrlyi[.]com/
https[:]//accounts.natrlyi[.]com/
hoangthikieuanh254@gmail[.]com
chenzhengyu1989@gmail[.]com
tonn9127@gmail[.]com

Detection coverage Talos shipped alongside the report:

ClamAV:  Html.Phishing.UAT11985-10060614-0
Snort 2: 1:67198
Snort 3: 7:31

Action checklist

1. Block and hunt the domains and sender addresses above across mail, proxy and DNS logs.
2. Move privileged and research-org accounts to phishing-resistant MFA (FIDO2/passkeys). Real-time AitM defeats OTP and push-approval MFA; passkeys are bound to the origin and don't relay.
3. Hunt anomalous Google session use — a valid session token appearing from a new ASN shortly after a credential prompt is the AitM tell.
4. Brief staff who attend or host events. The lure rides real conference themes, and the QR-code variant lands on paper, so an email filter alone won't catch it.

Context

This is the second China-linked Talos cluster we've covered this month that leans on consistent-language tradecraft over novel malware: UAT-11587 paired a Rust backdoor with Microsoft 365 dead drops, and Taiwan sat on its target list too. UAT-11985 spends its novelty on a dual-channel AitM proxy and, maybe, an LLM in the lure factory — but the defeat condition is the same tired one: any MFA a human can be talked into relaying in real time. Passkeys remain the line this tradecraft can't cross.