Learn
archived
UAT-11985 APT Uses AitM Phishing to Bypass Google MFA at Taiwan Research Orgs
- Engineer — Learn: The AitM technique harvests session tokens post-MFA, meaning standard TOTP/SMS MFA offers no protection; this reinforces the case for deploying phishing-resistant MFA (FIDO2/hardware keys) for privileged Google Workspace accounts.
- SOC/IR — Learn: No IOCs are published in the current disclosure, so there is nothing to sweep for now; the AitM-against-Google pattern maps to ATT&CK T1557 and T1566, and is worth incorporating into hunt hypotheses if your estate includes Taiwan-affiliated research partnerships.
- Leader — Skip
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.