I hope I played this card correct.

He gets the resource token AFTER he attacks.

This meant for me that during his first attack he only had 3 attack points. After this 1st attack he got his 1st token. We could destroy him with our player attack. He could never attack a 2nd time with his boosted 5 attack points.

Is that right?

That is right. Ufthak gaining resources is only a problem if you don't kill him right away.