CISCO Talos researchers track a mid-2026 spear-phishing operation, attributed to the actor UAT-11985, aimed at individuals connected with Taiwan’s research community. The campaign sent fake event invitations purporting to be from real bodies such as the Taiwan European Union Centre, the NCCU Institute of International Relations, and Taiwan Research Institute. The senders did not exist, and one recipient confirmed none of the institutions recognised the three speakers. The invitations drew on legitimate public announcements, making them appear credible at first glance.
The attack chain combines AI-assisted lure writing, hidden links, and an AitM (acquire-in-the-middle) phishing kit designed to capture Google credentials and MFA codes. The registration links redirected to a phishing site on a third-party platform, with malicious QR codes substituted on event posters, enabling “quishing” when scanned.
The AitM kit relays inputs via HTTP POST and WebSocket, collecting browser data, email, password, and MFA codes, and can present various MFA screens in real time, providing a live session token to the operator. Evidence includes language clues suggesting Simplified Chinese as the base language and obfuscated JavaScript. Victim numbers and successful intrusions were not disclosed.
Practical responses endorsed include verifying organisers through official channels, scrutinising links and QR codes, using phishing-resistant MFA (e.g., hardware keys), reviewing active Google sessions, and blocking lookalike domains such as natrlyi[.]com and morelessty[.]com.