Skip to content

Back to the catalog

UAT-11985: AI-assisted event lures delivering real-time Google AitM phishing
blog.talosintelligence.comwriteup

UAT-11985: AI-assisted event lures delivering real-time Google AitM phishing

Cisco Talos details UAT-11985, a spear-phishing campaign against Taiwan-based research organizations (impersonating institutions like the Taiwan European Union Centre and NCCU Institute of International Relations) that used AI-assisted, templated lure emails and poster-based QR code phishing (quishing) to drive victims to a real-time adversary-in-the-middle phishing kit. The kit impersonates Google sign-in across zh-CN/zh-TW/en locales, uses a split HTTP-POST/WebSocket architecture to mirror Google's live authentication flow and dynamically push MFA challenge screens, enabling full session-token theft and MFA bypass. Talos attributes the kit's localization architecture and lexical choices to a Simplified Chinese-speaking developer and publishes ClamAV/Snort coverage plus IOCs on GitHub.

TL;DR Talos exposes UAT-11985's AI-assisted, QR-code-augmented spear-phishing campaign using a real-time WebSocket-driven AitM kit that bypasses Google MFA.
Open original ↗
Document

What it is

UAT-11985's phishing kit is a real-time adversary-in-the-middle (AitM) proxy against Google sign-in, distinguished from typical automated AitM kits by being operator-driven: a human operator orchestrates each victim's authentication flow live rather than the kit running fully autonomously.

How it works

The flow has four stages, each with a named C2 event:

sequenceDiagram
    participant V as Victim browser
    participant P as Phishing page
    participant C as C2 (HTTP+WS)
    participant G as Real Google

    V->>P: loads fake sign-in
    P->>C: google_login_start (locale, UA, screen dims)
    C->>P: WebSocket session snapshot
    V->>P: enters email/phone
    P->>C: google_input_identifier
    C->>G: verify identifier
    G->>C: account exists? passkey enabled?
    C->>P: WS update: show password or passkey prompt
    V->>P: enters password
    P->>C: google_login_check (password, UA, identifier)
    C->>G: forward credentials
    G->>C: MFA challenge type/layout
    C->>P: WS update: render matching MFA screen

The split-channel design is the core mechanism: one-shot data (fingerprints, credentials, heartbeats) goes out over stateless HTTP POST, while the C2 pushes which MFA screen to render next over a persistent WebSocket — letting the kit mirror Google's live auth state and complete MFA bypass by relaying real Google challenges back to the victim.

The client JS is obfuscated with a static Base64 string array plus a while(!![]) { push/shift } control-flow shuffle, placed at the end of the HTML document specifically to defeat automated static deobfuscation. A hidden <section> containing an iframe (id: google-success-frame, sandbox="allow-scripts") loads a local asset (/google-login-assets/operation-success.html) to simulate a successful login.

Preconditions / Affected

Targets with browser locale (navigator.languages) set to zh-CN, zh-TW, or en — the kit only renders in those three locales, so it will not trigger for other language settings.

What to do

  • ClamAV signature: Html.Phishing.UAT11985-10060614-0
  • Snort SIDs: Snort2 1:67198, Snort3 7:31
  • IOCs published in Talos's GitHub repo (linked from the post)
  • Covered by Cisco Network Intrusion Prevention, Web Filtering, and Email Threat Prevention products

Caveats

Talos holds the Simplified-Chinese-developer attribution at only "moderate confidence," based on lexical/localization-structure inference rather than direct identification. The AI-assisted-authorship claim for the lure emails is explicitly stated as not conclusively provable from linguistic indicators alone.

Organisations named here

  • Html.Phishing.UAT11985-10060614-0
  • NCCU Institute of International Relations
  • Snort SID 1:67198
  • Snort SID 7:31
  • Taiwan European Union Centre
  • Taiwan Research Institute

Technologies named here

  • ClamAV
  • Google sign-in / Google authentication service
  • Google Forms
  • Snort
  • Cisco Talos IOC GitHub repository
  • Google

Techniques named here

  • Spear-phishing with event lures
  • Quishing
  • Adversary-in-the-Middle phishing
  • Link mismatch / deceptive hyperlinks
  • Hidden iframe success simulation
  • JavaScript obfuscation via string array rotation
  • Dual-channel C2 architecture
  • Browser locale-based victim targeting
  • Credential and session token harvesting

Threat actors named here

  • UAT-11985

Related in Threat Intel