Cisco Talos reports a China-nexus cluster (UAT-11587) using targeted spear‑phishing against government and policy organizations across Asia. The attackers spoof trusted senders and use an email that visually clones Gmail’s attachment preview to trick recipients into clicking a Cloudflare-hosted download link, leading to a multi-stage infection chain that installs the Antino backdoor.
Cisco Talos documented UAT-11587, a China-nexus cluster conducting targeted spear-phishing against government and policy organizations across Asia, including Taiwan, India, the Philippines, and Cambodia. The group relied on tailored decoy documents and a multi-stage infection chain to gain initial access, rather than a single generic phishing template.
One of the most notable techniques was a visual clone of Gmail's attachment preview placed directly inside the email body. Instead of a real attachment, the entire preview card was wrapped in an anchor tag linking to an attacker-controlled Cloudflare Pages URL. These links included a tracking parameter that allowed per-recipient logging, meaning the attackers could monitor exactly who clicked. The campaign's final payload was a custom Rust backdoor called Antino, which communicates through Microsoft 365 services such as Outlook and OneDrive rather than a dedicated command-and-control server, helping it blend into normal enterprise traffic.
The campaign combined two forms of trust abuse. First, sender identities were spoofed so that the visible From header displayed a trusted organization's name, while the actual envelope sender used an attacker-controlled domain sent through Migadu. This misalignment meant messages could still reach inboxes even when DMARC checks failed. Second, the fake Gmail attachment preview exploited a visual interface that recipients see constantly and rarely scrutinize, making the deceptive click feel routine.
Decoy content was also highly tailored, referencing real policy topics and events such as an Indo-Pacific forecast briefing, suggesting the attackers had detailed knowledge of their targets' interests and institutional context.
Organizations in government, foreign affairs, defense, and policy research should train staff to verify unexpected requests through a separate known channel, inspect links before clicking rather than trusting familiar-looking preview widgets, and treat highly relevant, well-tailored lures with extra caution rather than reduced suspicion.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
UAT-11587 is a China-nexus threat cluster that Cisco Talos observed spear-phishing government and policy organizations across Asia, including Taiwan, India, the Philippines, and Cambodia, starting in 2025.
The attackers recreated Gmail's native attachment preview widget inside the email HTML body, and the entire attachment card was wrapped in an anchor tag pointing to an attacker-controlled Cloudflare Pages URL rather than a real file.
Messages were sent through Migadu using an attacker-controlled envelope sender domain while the visible From header showed the impersonated organization's identity, so the receiving provider still accepted the message despite the DMARC failure.
The infection chain ultimately installed a custom Rust backdoor called Antino, which communicates through Microsoft 365 services like Outlook and OneDrive instead of a dedicated command server.
Picture this: you get an email that looks like Gmail, with a familiar contact and a clean attachment preview card. But in recent attacks on policy teams across Asia, that ‘attachment’ was just a fake Gmail widget. The whole card was one big link to a Cloudflare Pages download, kicking off a multi-stage Antino backdoor infection that hides inside Microsoft 365 traffic. Here’s the catch: the sender name looks trusted, but the real sending domain is different, and the ‘attachment’ sits inside the message. Hover it and you see a pages.dev link with tracking parameters, not a normal file or your organization’s domain. If an email shows a Gmail-style attachment card that opens a pages.dev link, stop. Don’t click it, forward it to security and confirm the file through your usual channel instead.
A China-nexus threat group targeted government and policy organizations across Asia using spear-phishing emails tailored to the victim’s interests. The emails used spoofed trusted senders and a realistic fake Gmail attachment preview that linked to attacker-controlled pages, ultimately installing…
A China-linked espionage group (UAT-11587) targeted Asian government and policy organizations using highly tailored phishing emails and realistic decoy documents. After a click, malware ultimately installed the “Antino” backdoor, which then hid its command-and-control traffic inside normal…
Researchers reported two China-aligned campaigns that used phishing and impersonation to target AI policy experts and multiple Asian government organizations. One campaign built rapport with “AI policy” themed outreach before sending links to a OneDrive credential-harvesting page, while another…
A China-aligned espionage group (TA419) targeted U.S. AI policy experts by impersonating well-known public figures and sending credible policy-related invitations. After victims replied, the attackers sent shortened links that led to a fake OneDrive login designed to capture passwords, MFA codes,…
Researchers say a China-aligned group (TA419) impersonated well-known AI policy figures and an Anthropic executive to lure US AI policy experts into replying to emails about a fake advisory committee or Senate report. Once a target engaged, the attackers sent shortened links that led through a fake…
This roundup describes several real-world social-engineering and human-abuse techniques, including trojanized “installer” lures (ClickFix), large-scale phone-based investment fraud, and stalkers misusing Chrome Sync after brief physical access. The items include clear workflows that can be turned…
