- Published
- Source
- Cisco Talos
- Filed under
- Phishing & scams, Malware & exploits, AI for defence
Cisco Talos identified an APT spear-phishing campaign against individuals affiliated with Taiwan research organizations. The operation leveraged legitimate public event themes and impersonated reputable academic and policy institutions.
Spotted a scam?
- Forward suspicious emails to report@phishing.gov.uk – the NCSC uses the reports to take scam sites down.
- Forward scam texts to 7726, free on most UK networks.
- Never share a one-time code, and check any request for money by calling a number you already trust.
Defender’s notebook
The attacker technique behind this story, in MITRE’s terms – and what to check in your own estate.
Adversary-in-the-Middle
Credential Access, CollectionWhat a defender checks
- Look for sign-ins where a session token reappears from a new device or location.
- Revoke sessions and reset passwords for anyone who entered credentials.
- Move to phishing-resistant MFA (passkeys, FIDO2), which a proxy can't relay.
Build the skillBlue Team Engineer · Identity & Access Management Engineering
Phishing
Initial AccessWhat a defender checks
- Search mail flow for the sender, subject and links, and pull every copy from mailboxes.
- Check who clicked or replied, and what signed in afterwards.
- Block the sender and URLs, and tell staff what to look for.
Build the skillBlue Team Analyst · Email & Phishing Investigation
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
MyCyberWay training
Blue Team Analyst · Email & Phishing Investigation
Someone will report this email. Know exactly what to do next.
Analyse a reported phishing email properly: headers, message trace and quarantine, what SPF, DKIM and DMARC failures tell you, and the indicators that make it business email compromise.
- Header forensics and message trace
- SPF, DKIM and DMARC failures explained
- Spotting business email compromise
Headlines and short summaries only, except where a public body publishes under an open licence. Every story links to its publisher, who owns it. MyCyberWay does not edit or endorse third-party reporting.
