UAT-11985 phishing campaign targets Taiwan research groups
A campaign tracked as UAT-11985 uses fake event invitations and adversary-in-the-middle pages to steal Google credentials and MFA codes from Taiwan-linked research targets.
UAT-11985 has been targeting people affiliated with research organisations in Taiwan with convincing event invitations that lead to fake Google sign-in pages. Cisco Talos says the campaign is built to steal account credentials and multi-factor authentication (MFA) codes, while The Hacker News reports that the operation uses both email and QR-code lures.12
The campaign matters because it does not rely on a single obviously malicious message. The invitations imitate legitimate academic and policy institutions, use real or plausible event details, and flatter recipients by presenting them as valuable experts. That combination is designed to make the target feel that registering is both credible and personally relevant.
How the campaign works
The emails typically follow a repeatable three-part structure. They open with an elaborate description of a geopolitical or policy topic, move into personalised praise for the recipient, and finish with event logistics and registration instructions. Talos says the repeated language and structure suggest the attackers are using an AI-assisted template to produce tailored lures at scale, although the researchers do not claim that every message was fully generated by an AI system.1
The attackers impersonated organisations including the Taiwan European Union Centre, National Chengchi University’s Institute of International Relations and the Taiwan Research Institute. The institutions named in the messages told Talos they could not confirm that the apparent senders were genuine representatives. The campaign therefore uses real institutional names and public event information as a credibility layer, rather than inventing every detail from scratch.1
Some messages also use quishing. The attackers modify posters for legitimate events so that a QR code sends a visitor to malicious infrastructure. That widens the target pool beyond the original email recipient: anyone who encounters a copied or printed poster could scan the altered code without having seen the phishing email.
The Google login trap
The registration link leads to a fake form that imitates Google’s visual language. The page then presents a spoofed Google login panel and relays the victim’s information through an adversary-in-the-middle (AitM) framework. In practice, that means the attacker sits between the victim and the real authentication service, forwarding information while capturing credentials and authentication challenges.
Talos observed the phishing kit collecting details such as the browser, device, locale and screen dimensions before the victim submits an account identifier. The kit then sends the identifier and password to attacker-controlled infrastructure, using HTTP requests for some data and a WebSocket connection for rapid authentication-state updates. That design lets the fake page mirror parts of Google’s sign-in process in real time, including MFA prompts.1
The spoofed panels support Simplified Chinese, Traditional Chinese and English locales. Talos says the language handling and the use of Chinese-language defaults point towards targeting of Chinese-speaking users, while the campaign’s targets and impersonated institutions concentrate the activity on Taiwan-linked research and policy communities.1
Why AI-assisted lures are useful to attackers
The suspected AI assistance is less important than the workflow it enables. A reusable template can preserve the same persuasive structure while swapping in a different event, institution, topic and recipient. That gives the attackers a way to produce messages that look individually written without requiring the same amount of manual work.
It also creates a useful warning for recipients. A polished invitation, accurate event details or flattering language should not be treated as proof that the sender is genuine. The underlying link matters more than the text displayed on the page, and event registration should be reached through the organiser’s verified website rather than an unexpected email or QR code.
Our opinion
UAT-11985 is a good reminder that phishing is becoming more context-aware, not merely more grammatically polished. The strongest part of this campaign is the abuse of trust around real events: a recipient may recognise the institution, topic and venue before noticing that the registration link goes somewhere else. Organisations should teach staff to verify event links independently and to report suspicious MFA prompts, particularly when a login page arrives through an invitation that was not expected.
The AitM component is the more serious detail. MFA remains valuable, but a victim can still be tricked into handing an active authentication challenge to an attacker-controlled relay. Account-protection teams should pair MFA with phishing-resistant methods where possible, monitor unusual sign-ins and make it easy for researchers to confirm invitations through a second channel.