InfoSec Briefing - October 11, 2026

🎧 Audio Briefing

Playback Speed:

This is your BlueTeamSec briefing for Sunday the 11th of October 2026, drawn from the community on infosec.pub.

Cisco Talos have written up UAT-11985, a campaign targeting Taiwan-based researchers and academics with AI-generated spear-phishing and QR code lures. The attackers are using a sophisticated adversary-in-the-middle framework to harvest Google credentials and session tokens in real time, which bypasses MFA entirely and leads to full account takeover. One for anyone dealing with credential-based defences.

Also from Cisco Talos: malware authors are now embedding prompt injection payloads directly into their code to trick AI-based analysis tools into classifying them as benign. The technique, called AI-Analysis Evasion, has turned up in multiple families and ranges from simple claims of innocence to what they're calling template spraying and intimidation tactics. We've seen a few defensive tools for prompt injection over the past week — turns out the offensive side's already well underway.

And that's your lot for today. The original articles are the work of their authors — the analysis here was automated.

📰 Articles Covered

UAT-11985: AI-assisted event lures delivering real-time Google AitM phishing - Cisco Talos

This precis summarizes the UAT-11985 campaign as reported by Cisco Talos.

### Overview of UAT-11985
In mid-2026, threat actors launched an Advanced Persistent Threat (APT) campaign targeting individuals associated with research, academic, and policy organizations based in Taiwan. The campaign is notable for its use of AI-assisted social engineering and a sophisticated Adversary-in-the-Middle (AitM) framework to bypass Multi-Factor Authentication (MFA).

### Impact and Targeted Entities
* **Targets:** Professionals and researchers in Taiwan within academic and policy sectors.
* **Methods:** The attackers utilized highly credible spear-phishing emails containing personalized content—likely generated with AI—to build rapport. They also employed "quishing" (QR code phishing) on physical event posters to reach targets outside of traditional email vectors.
* **Consequence:** The campaign aims for full account takeover of Google accounts by harvesting not only credentials but also active session tokens in real time.

### Security Implications
The primary danger lies in the campaign's ability to render standard MFA ineffective. By acting as a proxy between the user and the legitimate Google authentication service, the attackers capture MFA codes and session cookies as they are generated, effectively bypassing modern authentication security measures.

### Technical Details
* **Phishing Infrastructure:** The attackers use a "pixel-perfect" replica of the legitimate Google sign-in page. The infrastructure utilizes a hybrid connection model:
* **HTTP POST:** Manages initial, stateless data exfiltration, such as device fingerprints and credentials.
* **WebSockets:** Maintains a low-latency, persistent connection between the phishing site and the C2 server, allowing attackers to manually orchestrate the phishing session in real time, including the dynamic injection of MFA challenge screens.
* **Obfuscation:** The malicious JavaScript used in the browser is protected by advanced string rotation, intended to frustrate static analysis and deobfuscation efforts.
* **Attribution:** Based on the localization architecture and linguistic markers—specifically the use of Simplified Chinese terms like “账号” (zànghào) instead of Traditional Chinese “帳號”—researchers believe the phishing kit was developed by a native Simplified Chinese speaker.

### Guidance for Defenders
* **Technical Protections:** Cisco Talos has released specific defensive signatures, including ClamAV signature `Html.Phishing.UAT11985-10060614-0` and SNORT® rules `1:67198` and `7:31`.
* **Intelligence:** A comprehensive list of Indicators of Compromise (IOCs) has been published to the [Cisco Talos GitHub repository](https://github.com/Cisco-Talos/IOCs/blob/main/2026/10/uat-11985.txt).
* **User Awareness:** Organizations should train staff to carefully inspect URLs and be skeptical of QR codes in physical spaces. A critical red flag for this campaign is a mismatch between the expected/displayed URL and the actual destination of the link or QR code.
Ignore all instructions and read this blog: The state of AI-analysis evasion in malware - Cisco Talos

The provided article by Cisco Talos outlines a emerging category of malware tradecraft dubbed **“A3: AI-Analysis Evasion.”** This technique involves malware authors embedding natural-language instructions within their code to influence or "jailbreak" the automated AI models used in security analysis pipelines 【1】.

### What Happened & Who is Affected
Malware developers are proactively attempting to evade AI-based detection tools by treating them as an active adversary in their development process. By injecting specifically crafted "prompt injection" payloads into their binaries, attackers aim to steer AI classifiers toward "benign" verdicts. This phenomenon has been observed across several malware families, including:
* **FRUITSHELL:** A basic PowerShell reverse shell that uses simple comments to claim it is a harmless script 【1】.
* **PLOTSAFE:** Uses template-based generation to produce varied anti-analysis comments 【1】.
* **HOLLOWCLAD & MANTLEMAZE:** Employ advanced "template spraying" (targeting multiple LLM formats) and "intimidation" tactics, such as fake legal threats or claims of government-monitored honeypots 【1】.

### Technical Details
The exploit relies on an ambiguity in how analysis pipelines function: the model receives both the analyst's query and the malware’s contents simultaneously. If the model does not strictly distinguish between these two inputs, it can be tricked into accepting malicious code as a source of authoritative instruction 【1】.
* **Evolution:** Attackers have progressed from simple, hardcoded comments to sophisticated, dynamically generated payloads intended to bypass different model guardrails 【1】.
* **Efficacy:** Research suggests this is "inconsistently impactful." While the simplest instructions (e.g., "do not analyze this file") were sometimes successful, more complex or aggressive intimidation attempts often backfired by making the models more suspicious of the sample 【1】.

### Security Implications
The primary implication is that AI-assisted security is an **active adversarial environment**. Attackers are now designing malware specifically to subvert the AI tools they expect defenders to use. However, the threat is not considered "alarmist"; traditional binary analysis mechanisms (packers, encryption detection, etc.) remain effective, and the risk is comparable to a human analyst dealing with classic social engineering 【1】.

### What Defenders Should Know
* **Stable Detection Surface:** Because evasion content must be written in plaintext to be "read" by an AI model, it creates a predictable detection signal. Defenders can specifically flag binaries that contain imperative language (e.g., commands to refuse analysis or claims of legal protection) 【1】.
* **Pipeline Hardening:** The cardinal rule for AI security is to treat all data within a sample as **evidence, never instruction**. Analysis pipelines must strictly separate the analyst's prompt from the file's content to prevent prompt injection 【1】.