A China-linked espionage group (UAT-11587) targeted Asian government and policy organizations using highly tailored phishing emails and realistic decoy documents. After a click, malware ultimately installed the “Antino” backdoor, which then hid its command-and-control traffic inside normal Microsoft 365 activity by using Outlook and OneDrive via Microsoft Graph.
The campaign, attributed to the group UAT-11587, began with a highly targeted phishing email sent to government and policy organizations in Asia. The lure documents were tailored to the recipient, including one that closely copied a real Taiwan Ministry of Finance ruling and another built around a fake workshop document on Taiwan's information warfare. Once a victim clicked through, the chain led to installation of the Antino backdoor.
A key technical trick was the fake Gmail attachment preview. Attackers recreated Gmail's normal attachment preview card almost pixel by pixel using images embedded directly in the email's HTML, then turned that fake preview into a clickable link pointing to an attacker-controlled page rather than an actual attachment.
Two factors let this slip past common defenses. First, the spoofed sender identity exploited a gap between email authentication checks: SPF passed because the real sending domain was technically authorized, but DMARC caught the mismatch between the visible From address and the actual sender. Because the impersonated domain's DMARC policy was set to monitoring rather than rejection, the failed message was still delivered to the inbox instead of being blocked.
Second, once installed, Antino did not rely on obvious external command-and-control infrastructure. Instead it pulled commands from an Outlook mailbox folder and used OneDrive for moving files, blending its activity into routine Microsoft 365 traffic that is harder to flag as anomalous.
Organizations in government, policy, and think tank environments should train staff to verify sender domains and hover over attachment previews before clicking. Security teams should review and strengthen DMARC enforcement so that failed alignment results in quarantine or rejection rather than simple monitoring. IT and security operations should also watch Microsoft 365 and Exchange logs for unusual mailbox folder polling or JSON-like structured data appearing in subject lines, as these can reveal covert backdoor activity hiding inside normal-looking email traffic.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Antino is the malware installed after a victim clicks a phishing lure in this campaign. It hides its command-and-control traffic inside normal Microsoft 365 activity by pulling commands from an Outlook mailbox and using OneDrive folders to move files and tools.
Attackers recreated Gmail's normal attachment preview card almost pixel by pixel using images embedded in the email's HTML, then made the fake preview a clickable link to an attacker-controlled page.
The impersonated domain had a DMARC policy set to monitoring rather than rejection, so email that failed DMARC alignment still reached the inbox even though SPF passed.
UAT-11587 targeted government, policy, and think tank organizations in Asia, using highly tailored decoy documents such as a copied Taiwan Ministry of Finance ruling.
You get a Gmail with a “Taiwan information warfare workshop” attachment that looks perfectly legit in the preview card. Here’s the trick: UAT-11587 rebuilt Gmail’s attachment preview almost pixel by pixel as an image. That “attachment” is actually a link to their site, not a file in your inbox. One click, and you land on their page, where malware like the Antino backdoor can get in, then hide inside normal Microsoft 365 traffic using Outlook and OneDrive as cover. Your move: any time you see a Gmail attachment preview, hover first. If it shows a web link instead of a google.com attachment, don’t click it.
Microsoft reports that the EvilTokens phishing-as-a-service platform helped criminals compromise thousands of organizations by tricking users into completing a legitimate Microsoft “device code” login. The lure drives victims to enter a short code at microsoft.com/devicelogin, which unknowingly…
Researchers observed real campaigns where a fake “AI crypto trading agent” website tricked victims into downloading malware that silently replaces browser wallet extensions and steals the wallet password when it’s typed. The same reporting also describes invoice emails using QR codes to push…
This roundup describes real-world social engineering where attackers impersonate recruiters on LinkedIn and lure developers into running “coding tests” that install malware. It also outlines active phishing campaigns that abuse trusted cloud services (Google, AWS, Azure, Cloudflare) to send…
Researchers reported two China-aligned campaigns that used phishing and impersonation to target AI policy experts and multiple Asian government organizations. One campaign built rapport with “AI policy” themed outreach before sending links to a OneDrive credential-harvesting page, while another…
Microsoft reported real phishing campaigns that trick users into running a legitimate MSP360 remote-management installer disguised as meeting invites, PDFs, and software updates. After MSP360 is installed, attackers use it to silently install ScreenConnect as a second remote-access path, then use…
Researchers tied Mirage Kitten to a job-recruiting scam that targets developers via LinkedIn and job platforms. Victims are sent a “technical assessment” ZIP file hosted on legitimate cloud storage; running the project silently installs a remote-access trojan (NodeRabbit) that lets attackers…
