Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
5 IOCs
UAT-11985: AI-assisted event lures delivering real-time Google AitM phishing
Malware Families
Excerpt
Cisco Talos identified an advanced persistent threat (APT) spear-phishing campaign against individuals affiliated with Taiwan research organizations. The operation leveraged legitimate public event themes and impersonated reputable academic and policy institutions to establish credibility.  The phishing emails exhibited highly consistent structure, rhetoric, and personalization patterns, suggesting the threat actor likely used AI-assisted content generation to rapidly…
Read the original report →Diamond Model
Adversary
Infrastructure(5)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →5 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| URL | https://google.natrlyi.com/ | High | Score 58/100 | First seen |
| URL | https://google.centerhoti.com/ | High | Score 58/100 | First seen |
| URL | https://google.morelessty.com | High | Score 58/100 | First seen |
| URL | https://jmlh.morelessty.com/ | High | Score 58/100 | First seen |
| URL | https://accounts.natrlyi.com/ | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…