"The operation leveraged legitimate public event themes and impersonated reputable academic and policy institutions to establish credibility," Talos researcher Joey Chen said in an analysis.
UAT-11985: scope and targets
Cisco Talos has been tracking an advanced persistent threat (APT) spear-phishing campaign under the moniker UAT-11985 that began surfacing in mid-2026. According to the Talos analysis, the campaign targeted individuals affiliated with Taiwan research organizations and directed victims to an adversary-in-the-middle (AitM) phishing framework designed to harvest Google account credentials and multi-factor authentication (MFA) codes. The threat actor impersonated legitimate Taiwan-based institutions — including the Taiwan European Union Centre, NCCU Institute of International Relations, and Taiwan Research Institute — by fabricating sender identities to increase the invitations' credibility.
AI-assisted lures and a reusable social-engineering template
Talos describes the operation as likely using artificial intelligence (AI)-assisted content generation to produce bespoke lures quickly while maintaining a common social-engineering framework. The invitation emails share an almost-identical syntactic structure across different geopolitical topics, indicating reuse of a prompt or template. Each message follows a three-part pattern: a polished and overly elaborate opening describing geopolitical or policy context; a tailored middle section flattering the recipient to trigger engagement; and a final section with event logistics and registration instructions. Talos concluded that the consistent narrative structure, rhetorical style, personalized flattery, institutional impersonation, and deceptive registration mechanism point to a coordinated spear-phishing campaign rather than isolated spoofed invitations.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageQuishing and poster manipulation broaden the attack surface
Beyond email, the actor incorporated QR code phishing — often called "quishing" — by scraping legitimate event posters and modifying their QR codes to point to attacker-controlled infrastructure. Talos notes this expands the attack surface beyond the email inbox to secondary victims who might encounter printed or shared versions of event materials and scan a malicious QR code to "register" for an event.
The AitM Google Forms proxy: mechanics and data flows
The phishing site imitates the look of a legitimate Google Form, but its primary purpose is to serve a pop-up that prompts signing in with a Google account. Victims taken through that prompt encounter a pixel-perfect spoof of the Google login panel. Talos explains the fake site is an AitM proxy using obfuscated JavaScript to collect information and exfiltrate it in real time over a WebSocket connection while simultaneously forwarding the credentials to legitimate Google authentication servers.
The JavaScript payload first gathers device and browser metadata — locale, user agent, screen dimensions, and mobile-device status — and reports these details to the actor's command-and-control (C2) server with a "google_login_start" request before establishing the WebSocket connection. When a victim submits a password, the phishing page transmits the password, the account identifier, and the browser user-agent to the actor's HTTP C2 via a "google_login_check" request. From that position, the actor's server forwards credentials to Google's authentication service, mirroring the authentication state in real time.
Talos also observed the spoofed Google login panels support only Simplified Chinese (zh-CN), Traditional Chinese (zh-TW), and English locales, with region detection based on the browser's navigator.languages value — a detail Talos interprets as deliberate targeting of Chinese-speaking users. The actor splits one-shot uploads via POST requests from low-latency state updates over WebSocket to maintain a seamless credential-harvesting relay that can capture both passwords and MFA challenges.
What this means for Taiwan research affiliates, security teams, and event organizers
- For Taiwan research affiliates: Invitations that appear to come from known centers or institutes may still be fraudulent; the campaign specifically uses plausible event details and impersonated senders to prompt registration and sign-in with Google accounts.
- For technologists and security teams: The AitM proxy and the combined use of POST and WebSocket traffic to mirror authentication flows means detection efforts should look for anomalous WebSocket connections tied to authentication pages and for C2 requests labeled "google_login_start" and "google_login_check."
- For event organizers and academic institutions: Publicly posted event posters and registration materials can be repurposed with modified QR codes; verifying QR destinations and monitoring for copied materials with altered links should be part of event publication hygiene.
The campaign documented by Talos is notable for combining impersonation, automated content production, QR-code manipulation, and a live AitM relay that captures MFA challenges in real time. Taken together, those elements create a multichannel trap that bypasses simple inbox-focused defenses. The central question left by this record is operational: will defenders expand monitoring and verification controls around event registration flows, QR codes, and real-time authentication proxies to counter the specific techniques Talos has observed?
