UAT-11985 Uses AI-Written Lures and an AitM Phishing Kit Against Taiwan Researchers

Cisco Talos observed an APT-style spear-phishing campaign (actor UAT-11985) targeting Taiwan research organizations with fake event invitations and posters; lures showed signs of AI-assisted writing, hidden links and malicious QR codes directed victims to an account‑in‑the‑middle (AitM) phishing kit that relays Google credentials and MFA codes via HTTP POST and WebSocket to obtain live session cookies, and the kit uses obfuscated JavaScript and language artifacts suggesting a Simplified Chinese development base.