Talos exposes AI-assisted spear-phishing campaign bypassing Google MFA in real time
Cisco Talos documented a threat actor tracked as UAT-11985 running a spear-phishing campaign against Taiwan research organizations, impersonating academic and policy institutions using fabricated event invitations. The emails show patterns consistent with AI-assisted content generation, allowing the actor to rapidly customize lures while keeping a consistent social-engineering structure. The campaign also used quishing (malicious QR codes on altered event posters) and a real-time adversary-in-the-middle (AitM) phishing kit that impersonates Google sign-in pages to intercept credentials and MFA challenges, harvesting full authenticated session tokens. Talos assesses with moderate confidence the phishing kit's interface was originally built in Simplified Chinese before being localized to Traditional Chinese and English.