UAT-11985 Uses Fake Events to Phish Taiwan Research Affiliates

Cisco Talos has identified a spear-phishing campaign tracked as UAT-11985 that has targeted people affiliated with Taiwan research organisations since mid-2026. The operation uses fabricated event invitations and altered event posters to direct victims to an adversary-in-the-middle, or AitM, phishing framework built to capture Google account credentials and multi-factor authentication codes.

The actor impersonated Taiwan-based organisations including the Taiwan European Union Centre, the NCCU Institute of International Relations and the Taiwan Research Institute. Cisco Talos said the campaign appears likely to use AI-assisted content generation to produce tailored lures quickly while retaining a shared social-engineering design.

Event themes used to establish trust

The emails relied on legitimate or plausible public-event information and presented a registration link hosted on attacker-controlled infrastructure. When a recipient hovered over that link, it displayed a legitimate-looking Google Forms URL. Messages followed a near-identical three-part pattern: an elaborate geopolitical or policy introduction, flattering text tailored to the recipient, and event logistics covering the topic, date, venue and registration process.

In some cases, the attackers took genuine event posters from legitimate websites and replaced their QR codes. That quishing technique broadens exposure beyond email recipients, because anyone who encounters a printed or shared poster may scan the altered code to register. The combination of institutional impersonation, repeated rhetorical structure and deceptive registration mechanisms led Talos to assess the activity as a coordinated, targeted campaign.

Real-time relay targets Google authentication

The registration page mimics a Google Form but displays a sign-in prompt intended to make the form appear complete. Victims are then taken to a counterfeit Google login panel. The pixel-perfect page acts as an AitM proxy: obfuscated JavaScript collects information entered by the victim and relays it in real time to legitimate Google authentication servers.

Before opening a WebSocket connection, the payload gathers browser and device details, including locale, user agent, screen dimensions and mobile status, and sends them to the command-and-control server in a google_login_start request. When a password is submitted, the account identifier, password and browser user-agent are sent through an HTTP request named google_login_check. The actor-controlled server then forwards the credentials to Google.

The spoofed login panels support Simplified Chinese, Traditional Chinese and English, with locale detection based on navigator.languages, a detail Talos said strongly suggests an emphasis on Chinese-speaking users. By separating one-shot POST uploads from low-latency WebSocket updates, the operation can mirror Google’s changing authentication state during the login process. The broader pattern of trust abuse seen in Google security flaws and trust abuse patterns underlines why an apparently credible invitation must still be verified through an independent channel.

Practical implication for organisations

Research organisations should ensure staff verify event invitations with independently obtained institutional contacts rather than links or QR codes embedded in the invitation. Security teams should also treat Google sign-in prompts reached from registration workflows as a phishing signal and prioritise phishing-resistant MFA where Google accounts handle sensitive research communications.