Case uat-11985-taiwan-aitm-phishingAI phishingTaiwan
UAT-11985 uses AI-assisted event lures for Google AitM phishing in Taiwan
Cisco Talos identified an APT spear-phishing campaign using AI-assisted lures and real-time Google adversary-in-the-middle phishing against Taiwan research affiliates.
MediumAttack using AIStatus: Under investigationVerified case file
Open in the interactive mapCite this case
- Reported
- Oct 14, 2026
- Location
- Taiwan
- Target
- Individuals at Taiwan research organizations
- Severity
- Medium
- Triggered by
- UAT-11985
- Actor type
- Unknown
- Reported loss
- None reported
- CVE
- None
What happened
Cisco Talos identified an APT spear-phishing campaign using AI-assisted lures and real-time Google adversary-in-the-middle phishing against Taiwan research affiliates.
Impact: Unknown; the number of victims or compromised accounts is not stated.
Who triggered it
Actor: UAT-11985
Attribution: Cisco Talos tracks the cluster as UAT-11985 and calls it an APT; no country attribution is stated.
Motive: Unknown; targeting suggests intelligence or credential theft.
How it happened
Attack vector: Spear-phishing with public event-themed lures impersonating academic and policy institutions, leading to real-time Google AitM credential phishing.
Root cause: Targets were lured into entering credentials on AitM phishing pages.
Timeline
- Reported by Cisco Talos
Response
Cisco Talos published its analysis of the campaign.
Current status: Under investigation
Sources (open in a new tab)
- Cisco Talos blog.talosintelligence.com
Cite this case
UAT-11985 uses AI-assisted event lures for Google AitM phishing in Taiwan. AI Threat Watch, case uat-11985-taiwan-aitm-phishing, Oct 14, 2026. https://aithreat.io/cases/uat-11985-taiwan-aitm-phishing/
Permanent link: https://aithreat.io/cases/uat-11985-taiwan-aitm-phishing/