UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing

UAT-11985 Uses AI-Written Event Invites and QR Codes to Run Real-Time Google AitM Phishing on Taiwan Researchers

Cisco Talos has disclosed a spear-phishing campaign, tracked as UAT-11985, targeting individuals affiliated with Taiwan-based research and academic institutions that focus on international relations and European affairs. The operation, first observed in mid-2026 and detailed by Talos researcher Joey Chen in a report published October 8, 2026, combines AI-assisted spear-phishing emails, malicious QR codes on doctored event posters, and an operator-driven adversary-in-the-middle (AitM) phishing kit that impersonates Google's sign-in flow in real time — relaying credentials, multi-factor authentication (MFA) challenges, and complete authenticated session tokens to the attacker as the victim types.

Talos has not attributed the campaign to a known nation-state group and uses UAT-11985 ("Uncategorized Actor/Threat") as a provisional designation. The researchers assess with moderate confidence that the phishing kit's developer is a native speaker of Simplified Chinese, based on the vocabulary and localization choices baked into the kit's code — but they are explicit that this does not establish who is operating the campaign.

Details

How It Worked

AI-Assisted Event-Invite Lures

The spear-phishing emails followed a consistent three-part template across targets: an elaborate, somewhat grandiose description of a geopolitical or policy topic; a personalized flattery section praising the specific recipient's work; and event logistics (topic, date, venue, registration link). Talos found that the phrasing, sentence structure, and interchangeable praise lines were so uniform across otherwise varied topics that they likely came from a reusable AI-generated template rather than being hand-written for each target — a pattern Talos describes as "likely fueled by AI-assisted content generation," while stopping short of claiming definitive proof an LLM wrote the text.

The emails impersonated real organizations — the Taiwan European Union Centre, the NCCU Institute of International Relations, and the Taiwan Research Institute — using fabricated sender identities. When targets checked with the named organizations, the institutions could not confirm the purported senders as actual employees or representatives.

Disguised Links and Quishing

The malicious links were disguised to display what looked like a legitimate Google Forms URL on hover, leading victims to a convincing fake registration page. As a secondary vector, the attackers modified legitimate event posters — copies of real promotional material — by swapping in a malicious QR code, extending the attack surface to printed materials that recipients might display or forward, exposing a second tier of victims who scan the altered code directly.

Real-Time Google AitM Phishing

Once a victim reached the phishing page, Talos found a far more sophisticated flow than a static credential-harvesting form. The kit is a pixel-perfect replica of Google's sign-in interface, built to run as a live, operator-in-the-loop proxy rather than a pass-through form:

1. The page fingerprints the browser (locale, user agent, screen dimensions, mobile status) via a google_login_start request and selects a display locale (zh-CN, zh-TW, or en) based on the browser's navigator.languages property.
2. A WebSocket connection opens between the victim's browser and the attacker's infrastructure for real-time session-state synchronization.
3. When the victim enters an email/username, the phishing page relays it to the real Google servers via a google_input_identifier event and waits for Google's actual response.
4. Based on that response, the attacker — watching the session live over the WebSocket channel — instructs the phishing page whether to render a password prompt or a passkey challenge, mirroring exactly what the real account would show.
5. When the victim submits a password, a google_login_check request forwards it to the legitimate Google authentication endpoint.
6. Google's response (including any MFA requirement) is relayed back to the attacker, who updates the victim's on-screen prompt with the matching MFA challenge type in real time.
7. The victim completes authentication against the real Google backend, believing they've logged in normally — while the kit captures the credentials, the MFA response, and the resulting fully authenticated session token, enabling complete account takeover that survives a password reset.

Talos notes the kit's JavaScript uses heavy string-rotation obfuscation — Base64-encoded strings run through while(!![]) { push/shift } shuffle loops — specifically to defeat static deobfuscation tooling used by automated scanners.

Impact Assessment

Recommendations

For Google Workspace and IT Security Teams

Enforce phishing-resistant MFA — hardware security keys or platform passkeys (FIDO2/WebAuthn) — for any account handling sensitive research, policy, or international-affairs work; traditional OTP and push-based MFA can be relayed in real time by this class of AitM kit and should not be treated as sufficient protection on their own. Monitor for anomalous session activity (new device/IP combinations immediately following a login) and build detection for WebSocket-based traffic to unfamiliar domains at the point of authentication, since this kit's live relay depends on that channel. Where available, enable Google's Advanced Protection Program for high-risk individuals such as researchers and policy staff with public profiles.

For Research Organizations and Academic Institutions

Treat unsolicited event invitations referencing your organization's name or a partner institution's name with scrutiny, especially when they contain unusually elaborate or flattering language — verify event invitations through an independent channel (a phone call or a message to a known contact) rather than replying to the email or using contact details contained within it. Audit physical event materials — posters, flyers, printed QR codes — for tampering before they are displayed or distributed, and consider replacing printed QR codes with short, memorable registration URLs that are easier to visually verify.

For End Users

Hover over links before clicking, but do not rely on the displayed URL alone — this campaign disguised an attacker-controlled destination behind what appeared to be a legitimate Google Forms link. If a Google sign-in prompt appears after clicking an event-related link, navigate to accounts.google.com directly in a new tab instead of entering credentials into the page that loaded. If you suspect you entered credentials into a phishing page, immediately change your Google password and use Google's "Review recent security activity" and session-management tools to revoke all active sessions, rather than assuming a password change alone is sufficient.

Key Takeaways

1. UAT-11985, disclosed by Cisco Talos on October 8, 2026, targets individuals at Taiwan research institutions working on international relations and European affairs using AI-assisted spear-phishing emails.
2. The campaign impersonates real organizations — the Taiwan European Union Centre, NCCU Institute of International Relations, and Taiwan Research Institute — and adds a secondary quishing vector via tampered event posters.
3. The phishing kit is an operator-driven AitM proxy that relays victim input to real Google servers over HTTP and WebSocket channels in real time, letting the attacker mirror Google's own password/passkey/MFA prompts live.
4. The kit harvests not just credentials but complete authenticated session tokens, enabling account takeover that survives a password reset unless sessions are explicitly revoked.
5. Talos assesses with moderate confidence that the kit's developer is a native Simplified Chinese speaker, based on code localization choices — but this does not establish who is operating the campaign, and no nation-state attribution has been made.
6. Defense against this class of attack requires phishing-resistant MFA (FIDO2/passkeys), not just any MFA, since OTP and push-based codes can be relayed through the AitM channel in real time.

Sources

• The Hacker News: UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing
• Cisco Talos: UAT-11985 campaign