Cisco Talos researchers identified a sophisticated adversary-in-the-middle phishing kit, UAT-11985, that uses persistent WebSocket connections to relay authentication prompts in real time. The framework spoofs Google interfaces to capture passwords and multi-factor authentication challenges as victims enter them. This method allows attackers to bypass standard security controls by forwarding stolen credentials directly to the legitimate service.
Relevant URL: https://cybersecuritynews.com/google-aitm-phishing-kit/
