UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing

A threat actor tracked as UAT-11985 has been conducting a spear-phishing campaign targeting individuals affiliated with Taiwan research organizations. The campaign uses fake event invitations to lure victims to an adversary-in-the-middle (AitM) phishing framework. The goal is to harvest Google account credentials and multi-factor authentication (MFA) codes. The AitM technique allows attackers to bypass MFA protections by intercepting authentication tokens in real time. This represents a sophisticated APT-level operation targeting academic and research communities in Taiwan, likely for espionage purposes.