Loading story…
Cisco Talos identified a mid-2026 spear-phishing campaign by UAT-11985 targeting individuals affiliated with Taiwan-based research organizations. The actor impersonated academic and policy institutions, repurposed legitimate event information, and sent deceptive registration links and event posters containing malicious QR codes. Consistent email structures and personalized messaging suggested AI-assisted lure generation, but Talos could not conclusively establish large language model use.
The campaign used an operator-driven adversary-in-the-middle (AiTM) phishing kit that impersonated Google authentication, combining HTTP POST submissions with WebSocket updates to relay credentials and multifactor authentication challenges in real time. This enabled authenticated-session theft and account takeover, illustrating the credential and session interception risks covered by MITRE ATT&CK technique T1557. Talos assessed with moderate confidence that the kit’s interface was originally developed in Simplified Chinese, based on its localization architecture and terminology; this does not establish the operator’s origin. Organizations should prioritize phishing-resistant MFA, verify event invitations through independent channels, and revoke compromised sessions rather than relying on password resets alone.
Get the infrastructure and lures behind it.
3 events from the most recent confirmed update back to the earliest known activity.
In mid-2026, Cisco Talos observed a spear-phishing campaign targeting individuals affiliated with Taiwan-based research organizations. The attackers impersonated academic and policy institutions, using deceptive registration links and copied event posters with malicious QR codes to direct recipients to Google-themed phishing pages.
Talos disclosed that the phishing kit combined HTTP POST submissions and WebSocket updates to relay credentials and MFA challenges in real time, enabling authenticated-session theft and account takeover. The report also documented evidence of AI-assisted lure generation, assessed a Simplified Chinese origin for the interface with moderate confidence, and provided detection coverage and indicators of compromise.
An email recipient contacted the institutions impersonated in the phishing invitations. None could confirm that the three purported senders were employees or representatives.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 10 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
4 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourceblog.talosintelligence.com
Open sourcegithub.com
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A sophisticated phishing campaign has emerged, leveraging AI-assisted development to target Microsoft Outlook users, particularly Spanish speakers. The operation, active since March 2025, employs a modular phishing kit that mimics the Outlook login interface and uses real-time reconnaissance to enrich stolen credentials with IP and geolocation data. Stolen information is exfiltrated via Telegram bots and Discord webhooks, and the kit's evolution shows clear signs of AI-generated code, including clean structure and Spanish-language comments. Researchers identified the campaign through a unique mushroom emoji signature embedded in the phishing kit, which has been observed in over 75 deployments. In a parallel development, another phishing wave has exploited Google Cloud Application Integration to send convincing emails from legitimate Google addresses, bypassing traditional security filters. This campaign, uncovered by Check Point researchers, uses a multi-stage process: victims receive official-looking emails, are redirected through Google infrastructure, and ultimately land on a fake Microsoft login page designed to harvest credentials. The attack has targeted over 3,000 organizations globally, with significant activity in the United States, Asia-Pacific, and Europe. Both campaigns demonstrate the increasing sophistication and global reach of phishing operations using advanced technical methods and trusted platforms to deceive users.
Jun 29, 2026
China-aligned espionage actor **TA419** targeted U.S. artificial-intelligence policy experts at think tanks, universities, and law firms with credential-phishing campaigns focused on AI governance, export controls, supply chains, and military AI. Beginning July 8, the operators impersonated former White House technology official Lynne Edwards Parker and former State Department chief economist Heidi Crebo-Rediker, using fabricated policy invitations to establish contact. A related February operation impersonated a senior Anthropic employee and sought feedback on military integration of Claude. After recipients responded, TA419 directed them through URL shorteners and actor-controlled infrastructure to fraudulent OneDrive pages using a customized **Frameless BitB** adversary-in-the-middle kit. The phishing flow relayed genuine Microsoft 365/Entra ID authentication, including MFA and conditional-access prompts, and aimed to steal authenticated session cookies as well as credentials. Proofpoint assessed the activity as Chinese intelligence collection against U.S. AI-policy and national-security deliberations; it did not determine how many people were targeted, whether accounts were compromised, or whether data was taken. The campaign coincides with intensifying U.S.-China competition over frontier AI, semiconductor controls, open-source models, and military and industrial AI capabilities.
Oct 5, 2026
Cisco Talos Incident Response reported that phishing became the leading initial access vector in more than half of investigated incidents, with authentication abuse rising to 65% of cases. The firm highlighted an ongoing QR-code phishing campaign attributed to **UAT-11764** that targeted mainly Australian organizations using compromised Microsoft 365 accounts, tailored PDF attachments, and SharePoint- or other trusted cloud-hosted credential harvesting pages. After stealing credentials, the attackers accessed victim inboxes, created inbox rules to evade detection, and used the compromised accounts to spread additional phishing internally and externally. Talos also warned that phishing-as-a-service platforms such as **ARToken** are expanding attacker capabilities with device-code phishing, token abuse, **OAuth** device authorization flow abuse, persistent access via Primary Refresh Tokens, business email compromise, and SharePoint data exfiltration. In ransomware and pre-ransomware cases, including **Sinobi** and **Warlock** activity, operators maintained stealthy access by abusing legitimate remote management tools such as a trojanized **MeshAgent** binary and **Zoho Assist**. Healthcare was the most targeted sector, and Talos urged organizations to deploy phishing-resistant MFA, improve logging, patch exposed systems faster, and limit outbound email rates to reduce propagation.
Oct 9, 2026