APT Uses AI-Generated Lures in Google AitM Phishing on Taiwan
Cisco Talos has identified a sophisticated APT campaign targeting Taiwan-based research organisations that leverages AI-assisted content generation to produce highly personalised spear-phishing emails impersonating legitimate academic and policy institutions. The operation combines QR code phishing and an adversary-in-the-middle framework to intercept Google credentials and bypass MFA in real time. Code analysis of the phishing kit suggests a Simplified Chinese-speaking developer, pointing toward a likely China-nexus threat actor.