CYBERSECURITY researchers have disclosed a potent spear-phishing campaign, tracked by Cisco Talos as UAT-11985, that targeted individuals affiliated with Taiwan research organisations. The operation uses AI-assisted content generation to craft customised, highly plausible event invitations designed to seed credentials and MFA codes through a Google AitM (adversary-in-the-middle) framework.
Observations from mid-2026 show the campaign blending legitimate public-event themes with impersonations of Taiwan-based institutions, such as the Taiwan European Union Centre, NCCU Institute of International Relations, and Taiwan Research Institute, to bolster credibility.
A notable feature is the multi-channel lure: emails follow a three-part structure—an elaborate geopolitical context, recipient-specific flattery, and event logistics—supplemented by QR code “quishing” where posters are scraped from legitimate sites and altered to direct victims to attacker-controlled infrastructure. The assault site mimics a Google Form; victims are prompted to sign in with their Google credentials.
The capture is conducted via an AitM proxy using obfuscated JavaScript and a WebSocket link, with data relayed to a C2 server and then forwarded to Google’s authentication flow in real time. The spoofed login panels support zh-CN, zh-TW, and en locales, aligning with targeted speech preferences. Cisco Talos notes the near-identical narrative templates and institutional impersonation point to a coordinated campaign rather than a set of independent invites.
Practical responses include heightened vigilance for event invitations, verification of sender domains, and monitoring for anomalous Google Form redirects and QR code activity.