Date: 10/12/2026
Severity: High
Summary
Researchers uncovered UAT-11985, an APT spear-phishing campaign targeting individuals affiliated with Taiwan-based research organizations through AI-assisted event invitations and institutional impersonation. The campaign combines QR code phishing (quishing) with fake Google Forms and spoofed Google login pages to steal credentials and intercept multi-factor authentication (MFA) challenges. Its adversary-in-the-middle (AitM) phishing framework uses HTTP POST and WebSocket communications for real-time authentication relaying, credential harvesting, and session-token theft.
Indicators of Compromise (IOC) List
Domains/Urls | https://google.morelessty.com https://jmlh.morelessty.com/ https://google.centerhoti.com/ https://google.natrlyi.com/ https://accounts.natrlyi.com/ |
Email Address | hoangthikieuanh254@gmail.com chenzhengyu1989@gmail.com tonn9127@gmail.com |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "https://google.centerhoti.com/" or url like "https://google.centerhoti.com/" or siteurl like "https://google.centerhoti.com/" or domainname like "https://google.natrlyi.com/" or url like "https://google.natrlyi.com/" or siteurl like "https://google.natrlyi.com/" or domainname like "https://google.morelessty.com" or url like "https://google.morelessty.com" or siteurl like "https://google.morelessty.com" or domainname like "https://jmlh.morelessty.com/" or url like "https://jmlh.morelessty.com/" or siteurl like "https://jmlh.morelessty.com/" or domainname like "https://accounts.natrlyi.com/" or url like "https://accounts.natrlyi.com/" or siteurl like "https://accounts.natrlyi.com/" |
Detection Query 2 : | from IN ("hoangthikieuanh254@gmail.com","chenzhengyu1989@gmail.com","tonn9127@gmail.com") OR sender IN ("hoangthikieuanh254@gmail.com","chenzhengyu1989@gmail.com","tonn9127@gmail.com") OR receiver IN ("hoangthikieuanh254@gmail.com","chenzhengyu1989@gmail.com","tonn9127@gmail.com") |
Reference:
UAT-11985: AI-Assisted Google AitM Phishing