Reported by 2 outlets
Hackers Use AI-Generated Event Lures to Steal Google Accounts and Bypass MFA
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.70 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.01 / 0.6 · time to second source
- Recency
- × 0.02 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.1 / 10 = base × recency + community
Analysis
UAT-11985 runs an AI-assisted spear-phishing campaign against Taiwanese research organizations, using institutional event invitations with altered QR codes and adversary-in-the-middle phishing to steal Google credentials and bypass MFA. The operation repurposes real public event details to make fraudulent invitations credible, then intercepts authentication in real time. No CVEs are involved; the threat is purely social-engineering and session-theft infrastructure. A related post on GBHackers documents the same activity with additional technical detail on the phishing kit.
This matters because it couples AI-generated lure content with live AitM interception, making it harder to detect than static credential-harvesting pages. Organizations that rely on Google authentication and event-based collaboration should watch for unexpected event invitations that redirect through QR-based login flows. The campaign targets a specific vertical (research), which implies focused reconnaissance rather than broad spray.
What to watch: additional reporting on UAT-11985 infrastructure, any Google or Taiwanese CERT advisories, and whether the phishing framework is reused against other sectors. The GBHackers and malware.news sources cover the event details; verify any new IOCs against primary vendor or government feeds before acting.
Timeline
-
original reporting
Hackers Use AI-Generated Event Lures to Steal Google Accounts and Bypass MFA
gbhackers.com · 1d ago · October 12th, 2026
An advanced persistent threat spear-phishing campaign targeting individuals affiliated with Taiwanese research organizations, combining likely AI-assisted event invitations with real-time Google authentication interception. Tracked as UAT-11985, the operation uses institutional impersonation, altered QR codes, and an adversary-in-the-middle phishing framework to steal credentials and authenticated sessions. Attackers repurposed legitimate public event information to make fraudulent invitations […] The post Hackers Use AI-Generated Event Lures to Steal Google Accounts and Bypass MFA appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from malware.news
UAT-11985: AI-assisted event lures delivering real-time Google AitM phishing
malware.news · 5d ago · October 8th, 2026
Cisco Talos identified an advanced persistent threat (APT) spear-phishing campaign against individuals affiliated with Taiwan research organizations. The operation leveraged legitimate public event themes and impersonated reputable academic and policy institutions to establish credibility. The phishing emails exhibited highly consistent structure, rhetoric, and personalization patterns, suggesting the threat actor likely used AI-assisted content generation to rapidly customize invitation lures for different targets while maintaining a common social engineering framework. Beyond traditional email phishing, the actor incorporated QR code phishing (quishing) techniques by modifying legitimate event posters with malicious QR codes, expanding the attack surface beyond email recipients to secondary victims who may encounter printed materials. The campaign deployed an advanced adversary-in-the-middle (AitM) phishing framework that impersonated Google authentication pages and utilized a hybrid HTTP and WebSocket architecture to synchronize authentication workflows in real time, enabling the interception of credentials and multi-factor authentication (MFA) challenges. After technical analysis of the phishing kit, Talos assesses with moderate confidence that the user interface was originally developed in Simplified Chinese and later adapted for Traditional Chinese and English. The localization architecture, Simplified Chinese default language branch, and mainland-Chinese lexical usage