China-Nexus Spearphish Fakes Gmail Attachments

How the attack worked

Cisco Talos documented UAT-11587, a China-nexus cluster conducting targeted spear-phishing against government and policy organizations across Asia, including Taiwan, India, the Philippines, and Cambodia. The group relied on tailored decoy documents and a multi-stage infection chain to gain initial access, rather than a single generic phishing template.

One of the most notable techniques was a visual clone of Gmail's attachment preview placed directly inside the email body. Instead of a real attachment, the entire preview card was wrapped in an anchor tag linking to an attacker-controlled Cloudflare Pages URL. These links included a tracking parameter that allowed per-recipient logging, meaning the attackers could monitor exactly who clicked. The campaign's final payload was a custom Rust backdoor called Antino, which communicates through Microsoft 365 services such as Outlook and OneDrive rather than a dedicated command-and-control server, helping it blend into normal enterprise traffic.

Why it succeeded

The campaign combined two forms of trust abuse. First, sender identities were spoofed so that the visible From header displayed a trusted organization's name, while the actual envelope sender used an attacker-controlled domain sent through Migadu. This misalignment meant messages could still reach inboxes even when DMARC checks failed. Second, the fake Gmail attachment preview exploited a visual interface that recipients see constantly and rarely scrutinize, making the deceptive click feel routine.

Decoy content was also highly tailored, referencing real policy topics and events such as an Indo-Pacific forecast briefing, suggesting the attackers had detailed knowledge of their targets' interests and institutional context.

What to watch for

• Attachment previews that are actually clickable images or cards embedded in the email body rather than genuine file attachments
• Links pointing to unexpected cloud-hosting domains like pages.dev, especially with tracking parameters in the URL
• Sender names that look familiar but whose underlying domain or envelope sender doesn't match the organization
• Unsolicited event invitations or official-looking documents that closely match a recipient's specific job function

Building resistance

Organizations in government, foreign affairs, defense, and policy research should train staff to verify unexpected requests through a separate known channel, inspect links before clicking rather than trusting familiar-looking preview widgets, and treat highly relevant, well-tailored lures with extra caution rather than reduced suspicion.

What is UAT-11587?

UAT-11587 is a China-nexus threat cluster that Cisco Talos observed spear-phishing government and policy organizations across Asia, including Taiwan, India, the Philippines, and Cambodia, starting in 2025.

How did the fake Gmail attachment trick work?

The attackers recreated Gmail's native attachment preview widget inside the email HTML body, and the entire attachment card was wrapped in an anchor tag pointing to an attacker-controlled Cloudflare Pages URL rather than a real file.

How did the sender spoofing bypass DMARC?

Messages were sent through Migadu using an attacker-controlled envelope sender domain while the visible From header showed the impersonated organization's identity, so the receiving provider still accepted the message despite the DMARC failure.

What payload did this campaign deliver?

The infection chain ultimately installed a custom Rust backdoor called Antino, which communicates through Microsoft 365 services like Outlook and OneDrive instead of a dedicated command server.