APT Group Uses Fake Google Event Invites to Steal Credentials
UAT-11985 deploys adversary-in-the-middle phishing targeting Taiwanese research affiliates. The campaign harvests Google account credentials and MFA codes via deceptive event invitations.
TL;DR
- UAT-11985 launched a spear-phishing campaign against Taiwan-linked researchers.
- Attackers used fake Google Calendar event invites to redirect victims.
- The goal was to steal Google account login credentials and MFA tokens.
- An adversary-in-the-middle (AitM) framework was used for credential harvesting.
- Organizations should review email security and user awareness training protocols.
Cybersecurity researchers have uncovered a sophisticated spear-phishing operation, tracked as UAT-11985, that specifically targeted individuals associated with research organizations in Taiwan. The attackers leveraged deceptive Google Calendar event invitations to trick victims into visiting malicious domains.
These domains hosted an adversary-in-the-middle (AitM) phishing framework designed to capture sensitive login information, including both Google account credentials and multi-factor authentication (MFA) codes. This method allows attackers to bypass traditional security measures and gain unauthorized access to high-value accounts.
Attack Vector and Technique
- The group sent fake Google Calendar event invitations to selected targets.
- Links in the invites redirected users to attacker-controlled AitM sites.
- These sites mimicked legitimate Google login pages to collect credentials.
- Multi-factor authentication codes were also captured in real-time.
- Use of AitM technique enables session hijacking post-login.
Target Profile and Impact
- Victims were primarily affiliated with research institutions in Taiwan.
- The campaign aimed to compromise Google Workspace accounts.
- Access to these accounts could lead to data theft or further infiltration.
- Researchers warn of potential follow-up attacks using stolen identities.
- Organizations are advised to enhance email filtering and user education.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.