Cisco Talos has identified a phishing campaign targeting people affiliated with Taiwanese research organizations that relays Google login credentials and multi-factor authentication challenges in real time. The activity, tracked as UAT-11985, uses academic event invitations and modified QR-code posters to draw victims into counterfeit sign-in pages.
The researchers observed the campaign in mid-2026. Its messages impersonated institutions including the Taiwan European Union Centre, the National Chengchi University Institute of International Relations and the Taiwan Research Institute, combining genuine or plausible event details with fabricated sender identities.
Recipients were directed toward registration links that appeared to point to familiar services. In one example, the visible text resembled a Google Forms address, while the actual hyperlink led to attacker-controlled infrastructure. A spoofed form then redirected the user to a fake Google login page.
The operation also altered QR codes on posters copied from legitimate events. Talos says that approach could expose additional people if recipients printed or displayed the posters and others scanned them, extending the lure beyond the original email audience.
The authentication kit uses an adversary-in-the-middle design, placing attacker infrastructure between the victim and the real Google service. Captured credentials and challenge responses are submitted through HTTP requests, while a persistent WebSocket connection updates the fake page as the genuine authentication process advances.
That live coordination allows an operator to present the appropriate additional authentication screen and relay the victim’s response. Talos describes the framework as capable of harvesting authenticated session tokens, turning the credential-capture workflow into account takeover.
The kit’s interface supports Simplified Chinese, Traditional Chinese and English. Talos assesses with moderate confidence that it was originally developed in Simplified Chinese, based on the translation architecture, default language and vocabulary. The report attributes those characteristics to the developer’s working language.
Talos also assesses that the invitation messages likely used AI-assisted content generation. It bases that assessment on repeated structure, interchangeable praise and rapid customization across recipients and topics.
Talos has published a ClamAV signature, Snort detection rules and indicators of compromise to help defenders identify the campaign’s phishing infrastructure. The detection resources accompany the technical analysis of the fake sign-in pages and their real-time command channel.
Sources: Cisco Talos
–
By the ID Tech Editorial Team
