MEDIUMApt
Global

UAT-11985: AI-assisted event lures delivering real-time Google AitM phishing

·Source: Cisco Talos

Updated:

Executive Summary

Cisco Talos identified an APT spear-phishing campaign against individuals affiliated with Taiwan research organizations. The operation leveraged legitimate public event themes and impersonated reputable academic and policy institutions.

Analysis

Cisco Talos identified an APT spear-phishing campaign against individuals affiliated with Taiwan research organizations. The operation leveraged legitimate public event themes and impersonated reputable academic and policy institutions.
Source Attribution

Originally published by Cisco Talos on Oct 8, 2026.

Related Threats

MEDIUMApt

How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia

Kaspersky GReAT experts discovered a new UEFI bootkit, BlackX. It exploits the Baton Drop vulnerability (CVE-2022-21894) and is similar to the BlackLotus bootkit.

CVE-2022-21894
Securelist (Kaspersky)
CRITICALApt

CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP

Overview On October 21, 2026, the PHP project announced security releases for two critical vulnerabilities in PHP. CVE-2026-109618 can corrupt memory during out-of-memory (OOM) handling, while CVE-2026-109619 is a use-after-free flaw involving state retained between requests. Both have a CVSSv4 score of 9.2 and both can allow for unauthenticated remote code execution (RCE) with the web worker's pr

CVE-2026-109618CVE-2026-109619
Rapid7
MEDIUMApt

Decades-Old Windows Utility Powers Modern ClickFix Attack

The attack uses malicious Google search results related to Amazon and leverages the 'finger' utility to launch a CAPTCHA that installs malware, including the Lumma stealer.

Dark Reading