GajShield Threat Advisory — UAT-11985 Google AitM Phishing Kit: Network IOC and Credential-Relay Coverage

Severity: High | Priority: 2

This GajIPS update adds network-layer detection for UAT-11985. The group runs spear-phishing campaigns against individuals affiliated with Taiwan-based research organisations. Its emails are event invitations that appear to be AI-generated and impersonate real academic and policy institutions. Some carry genuine event posters with the QR codes swapped for malicious ones. Victims are taken to a fake Google Form that redirects them to a replica Google sign-in page. That page runs an operator-driven adversary-in-the-middle (AitM) kit, which relays every sign-in step to Google's real authentication service as it happens. This lets the attacker get past multi-factor authentication and take over the account.

The new signatures detect the campaign at several stages:

• lookups and connections from hosts in your network to the phishing infrastructure Talos has published;
• the phishing kit sending a victim's account identifier and password to the attacker, where SSL inspection is enabled;
• the kit's fake "sign-in successful" page being shown to the victim.

Infrastructure alerts mean a user has opened a UAT-11985 phishing link or scanned one of its QR codes. Find the user and ask whether they entered any Google account details. Search mail logs for the lure email to identify other recipients.

Alerts for the account identifier being sent mean the user has started entering details on the phishing page. Alerts for the password being sent, or for the success page, mean the credentials have already reached the attacker. In that case, assume the attacker now holds a signed-in session and act immediately:

• reset the Google account password;
• revoke all active sessions and app passwords;
• review recent sign-ins, recovery settings, mail-forwarding rules and connected third-party apps.

Because the kit relays MFA prompts as they happen, MFA alone does not protect the account. Consider moving targeted users to passkeys or hardware security keys.